I want to import only data that are on a several namespaces

Elastic Stack Beats
1

Hello,

I want to injest via filebeat only data from containers that are in a certain namespace. Is there a possibility to do that?

2

I have tried the following and now it does drop all events.

processors:
  - drop_event:
      when:
        not:
          equals:
            kubernetes.namespace: ["name"]

Any idea on how to make this work?

3

Can you post a sample Filebeat event that should be ingested? You can use output.console.enabled: true in your Filebeat configuration to print out the event.

Shaunak

4

I have figured it out by using regexp and filtering the log.file.path field. with it.