Hi
i run filebeat on Kubernetes cluster. We use them for send logs to Kafka.
Sorry, but I'm rookie on Filebeat :).
In our Kubernetes cluster we have a namespace naming convention:
-
, for example:
dev-deathstar.
On Kafka topic is created only by the application name.
In configuration file for Filebeat we use:
a) processors: add_kubenetes_metadata, add_host_metadata
b) ouput:
output.kafka:
topic: '%{[kubenetes.namespace]}-k8s.log
in logs I see metadata for example:
"kubernetes": {
"namespace": "dev-deathstar",
Now is the questions:
is there possibility to create a new variables that we can use regular expression to get only data that we need, for example:
variable name: k8snamespace
value: deathstar
After successfully use regexp we should set our topic name as following:
topic: %{[k8snamespace]}-k8s.log
Thankful for any help.
Regards
tom