# Filebeat autodiscover kubernetes and set indexname per namespace

**URL:** <https://discuss.elastic.co/t/filebeat-autodiscover-kubernetes-and-set-indexname-per-namespace/310443>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [July 23, 2022, 7:20am UTC](https://discuss.elastic.co/t/filebeat-autodiscover-kubernetes-and-set-indexname-per-namespace/310443 "2022-07-23T07:20:02Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![farhad\_kh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/farhad_kh/32/108251_2.png) [@farhad\_kh](https://discuss.elastic.co/u/farhad_kh)\
**Post date:** [July 23, 2022, 7:20am UTC](https://discuss.elastic.co/t/filebeat-autodiscover-kubernetes-and-set-indexname-per-namespace/310443/1 "2022-07-23T07:20:02Z")

</div>

hi i want to use autodiscover for log shiping to elastic and i neesd add indexname per namespace  
but i get errore whene deploy manifest

```auto
2022-07-23T07:15:19.798Z ERROR instance/beat.go:916 Exiting: error in autodiscover provider settings: error setting up kubernetes autodiscover provider: missing or invalid condition
Exiting: error in autodiscover provider settings: error setting up kubernetes autodiscover provider: missing or invalid condition

```

anyone can help me ?  
this is my config

```auto

apiVersion: v1
kind: ConfigMap
metadata:
  name: filebeat-config
  namespace: kube-logging
  labels:
    k8s-app: filebeat
data:
  filebeat.yml: |-
    filebeat.autodiscover:
      providers:
        - type: kubernetes
          host: ${HOSTNAME}
          hints.enabled: true
          hints.default_config.enabled: false
          labels.dedot: true
          annotations.dedot: true
          templates:
            - condition:
                  - equals:
                      kubernetes.namespace: kube-logging
              config:
                - type: container
                  paths:
                    - /var/log/containers/*-${data.kubernetes.container.id}.log
                     # exclude_lines: ["^\\s+[\\-`('.|_]"] # drop asciiart lines
                  processors:
                    - decode_json_fields:
                        fields: ["message"]
                        target: "json_message"
                        process_array: true
                    - add_fields:
                        ownerlog: elastic
            - condition:
                 - equals:
                     kubernetes.namespace: development
              config:
                 - type: container
                   paths:
                    - /var/log/containers/development*-${data.kubernetes.container.id}.log
                   processors:
                    - add_fields:
                       ownerlog: development
    processors:
      - add_host_metadata:
      - add_kubernetes_metadata:
          namespace: 'kube-system'
          in_cluster: true
          default_matchers.enabled: false
          default_indexers.enabled: false
          host: ${NODE_NAME}
          matchers:
            - logs_path:
                logs_path: '/var/log/containers'
                resource_type: 'pod'
    output.elasticsearch:
      hosts: ['${ELASTICSEARCH_HOST:elasticsearch.kube-logging.svc.cluster.local}:${ELASTICSEARCH_PORT:9200}']
      pipelines:
      - pipeline: "development"
        when.equals:
          #kubernetes.namespace: development
          fields.ownerlog: development
      indices:
      - index: "sre-development-%{[fields.logtype]}-%{+xxxx.ww}"
        when.equals:
          fields.ownerlog: development
          #kubernetes.namespace: development

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 20, 2022, 9:20am UTC](https://discuss.elastic.co/t/filebeat-autodiscover-kubernetes-and-set-indexname-per-namespace/310443/2 "2022-08-20T09:20:23Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.