Filebeat исключить kubernetes namespace

Elastic Stack Beats
1

Filebeat работает как DaemonSet в kubernetes. Пытаюсь исключить некоторые namespace, такие как "kube-system" и "calico-system".

ConfigMap: filebeat.yml выглядит следующим образом. Что я делаю не так? С таким конфигом вообще ничего не записывается.

   - type: container
      paths:
        - /var/log/containers/*.log
      exclude_files:
        - /var/log/containers/java.*
      processors:
        - drop_event:
            when:
              equals:
                  or:
                    - kubernetes.namespace: "kube-system"
        - add_kubernetes_metadata:
            host: ${NODE_NAME}
            matchers:
            - logs_path:
                logs_path: "/var/log/containers/"
2

I can't read or write Russian so I used Google Translate to convert your post to English and have also replied in English. If I misunderstood something, I apologize.

What happens if you comment out the drop_event processor from your configuration? Do you record all events? If so, can you post one of the recorded events here please so we can look at the fields in it?

Order of processors is significant. The kubernetes.* metadata fields are added by the add_kubernetes_metadata processor. So you probably want to swap the order of the processors in your configuration so add_kubernetes_metadata comes before drop_event.

Shaunak

3

Shaunak i'm trying to exclude some namespaces, because it's takes disk space.

someone have correct config how to exclude namespaces?