# How to create indices based on kubernetes metadata

**URL:** <https://discuss.elastic.co/t/how-to-create-indices-based-on-kubernetes-metadata/120525>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [February 19, 2018, 8:22pm UTC](https://discuss.elastic.co/t/how-to-create-indices-based-on-kubernetes-metadata/120525 "2018-02-19T20:22:46Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Rohit\_Vyavahare](https://avatars.discourse-cdn.com/v4/letter/r/f4b2a3/32.png) [@Rohit\_Vyavahare](https://discuss.elastic.co/u/Rohit_Vyavahare)\
**Post date:** [February 19, 2018, 8:22pm UTC](https://discuss.elastic.co/t/how-to-create-indices-based-on-kubernetes-metadata/120525/1 "2018-02-19T20:22:46Z")

</div>

I am using filebeat in kubernetes to ship logs to Elasticsearch.  
I want to create indexes based on namespaces . I tried this :

> output.elasticsearch:  
> hosts: ["[http://localhost:9200](http://localhost:9200)"]  
> index: "filebeat-%{[beat.version]}-%{+yyyy.MM.dd}"  
> indices:  
> - index: "namespace1-%{[beat.version]}-%{+yyyy.MM.dd}"  
> when.contains:  
> kubernetes.namepsace: "namespace1"  
> - index: "namespace2-%{[beat.version]}-%{+yyyy.MM.dd}"  
> when.contains:  
> kubernetes.namepsace: "namespace2"

But it is not creating those indexes.  
Can anyone please help me?

---

<div class="post-metadata">

**Author:** ![exekias](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/exekias/32/28718_2.png) [@exekias](https://discuss.elastic.co/u/exekias)\
**Post date:** [February 19, 2018, 10:26pm UTC](https://discuss.elastic.co/t/how-to-create-indices-based-on-kubernetes-metadata/120525/2 "2018-02-19T22:26:40Z")

</div>

Hi @Rohit_Vyavahare,

Please use preformatted text when pasting confs, indenting is lost if not and we cannot really troubleshoot the issue.

From what I can tell, you can have some things into account:

- There is a type, you are writing `kubernetes.namepsace`, notice the name **ps** ace.
- You can use variables in the index setting, so this could be:

```auto
index: "filebeat-%{[beat.version]}-%{+yyyy.MM.dd}"
indices:
  - index: "%{[[kubernetes.namespace]]}-%{[beat.version]}-%{+yyyy.MM.dd}"
    when.regexp:
     kubernetes.namepsace: ".*"

```

Best regards

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [February 19, 2018, 10:53pm UTC](https://discuss.elastic.co/t/how-to-create-indices-based-on-kubernetes-metadata/120525/3 "2018-02-19T22:53:03Z")

</div>

Please format logs, configs and terminal input/output using the `</>`-Button or [markdown code fences](https://help.github.com/articles/creating-and-highlighting-code-blocks/#fenced-code-blocks). This forum uses Markdown to format posts. Without proper formatting, it can be very hard to read your posts.

Config files using YAML are sensitive to formatting and indentation. Without proper formatting it is difficult to spot any errors in your configs.

You get any errors in filebeat debug log? Do you find events with `kubernetes.namespace: namespace1` in the filebeat index?

Given the namespace name doesn't change this should work better:

```auto
output.elasticsearch:
  index: "%{[kubernetes.namespace]:filebeat}-%{[beat.version]}-%{+yyyy.MM.dd}"

```

---

<div class="post-metadata">

**Author:** ![Rohit\_Vyavahare](https://avatars.discourse-cdn.com/v4/letter/r/f4b2a3/32.png) [@Rohit\_Vyavahare](https://discuss.elastic.co/u/Rohit_Vyavahare)\
**Post date:** [February 19, 2018, 11:16pm UTC](https://discuss.elastic.co/t/how-to-create-indices-based-on-kubernetes-metadata/120525/4 "2018-02-19T23:16:11Z")

</div>

Thank you @steffens , this solved my problem. My apologies for question formating.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 19, 2018, 11:16pm UTC](https://discuss.elastic.co/t/how-to-create-indices-based-on-kubernetes-metadata/120525/5 "2018-03-19T23:16:25Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.