Filebeat error with helm3

I am getting error while deploying autodiscover in our environment
Error: Exiting: error in autodiscover provider settings: error setting up kubernetes autodiscover provider: missing field accessing 'filebeat.autodiscover.providers.0.templates.0.condition.equals' (source:'filebeat.yml')

Below is the helm values.yaml file

image:
  tag: 7.6.0

overrideConfig:
  filebeat.config:
    modules:
      path: ${path.config}/modules.d/*.yml
      # Reload module configs as they change:
      reload.enabled: true

  filebeat.autodiscover:
    providers:
    - type: kubernetes
      templates:
      - condition.equals:
          kubernetes.namespace: "*"
          config:
          - type: container
            paths:
            - /var/log/containers/*-${data.kubernetes.container.id}.log
  processors:
  - add_kubernetes_metadata:
      in_cluster: true
  - drop_event:
      when:
        or:
          - contains:
              kubernetes.namespace: "kube"
          - contains:
              kubernetes.namespace: "platform"
          - contains:
              kubernetes.namespace: "default"        
  - add_cloud_metadata:
  - add_fields:
      target: kubernetes

Hi @Raman_Sawhney :slightly_smiling_face:

I think you have a indentation problem in your YAML. For example, inside condition.equals you have an incorrectly indented config key. Check carefully this kind of issues, they are pretty common :sweat_smile:

Thanks Mario!
have to be very careful while writing yaml.
One more thing i need to confirm.

does kubernetes version matters while creating filebeat autodiscover. i mean is it common to get errors on the previous version like 1.15 and the things works fine on newer versions 1.18?

and if we are creating filebeat yaml via kubernetes manifest or if we are creating it via helm charts whatever we are creating in filebeat.yaml works fine with both manifest and helm.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.