If more than one condition is met, then the log will be collected only once or more than once

Elastic Stack Beats
,
1

Hello, I'm using autodiscover in filebeat, I want to know, if there is a pod, name is my-app-backend, does it match only the first condition or all (other) condition ? Was container's log collected once or twice? I hope only once

Here is my filebeat config:

filebeat.autodiscover:
  providers:
  - type: kubernetes
    hints.enabled: true
    templates:
    - condition:
       contains:
         kubernetes.pod.name: "-backend"
      config:
      - type: container
        paths:
         - /var/log/containers/${data.kubernetes.pod.name}_${data.kubernetes.namespace}_${data.kubernetes.container.name}-*.log
        format: docker
        multiline.type: pattern
        multiline.pattern: '^[0-9]{4}-[0-9]{2}-[0-9]{2}'
        multiline.negate: true
        multiline.match: after
        max_bytes: 5242880
    - condition:
        contains:
          kubernetes.pod.name: "my-app"
      config:
      - type: container
        paths:
         - /var/log/containers/${data.kubernetes.pod.name}_${data.kubernetes.namespace}_${data.kubernetes.container.name}-*.log
        format: docker
        max_bytes: 5242880
    
processors:
  ...

output.kafka:
  ...
2

I asked chatgpt, it said filebeat will collect twice. I hope we can have a continue keywork just like alertmanager, it allows us to control the behavior of multiple matches:

3

I really wish filebeat have this feature