# Kubernetes autodiscover indices

**URL:** <https://discuss.elastic.co/t/kubernetes-autodiscover-indices/203752>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [October 16, 2019, 6:15am UTC](https://discuss.elastic.co/t/kubernetes-autodiscover-indices/203752 "2019-10-16T06:15:26Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![bstavenuiter](https://avatars.discourse-cdn.com/v4/letter/b/90db22/32.png) [@bstavenuiter](https://discuss.elastic.co/u/bstavenuiter)\
**Post date:** [October 16, 2019, 6:15am UTC](https://discuss.elastic.co/t/kubernetes-autodiscover-indices/203752/1 "2019-10-16T06:15:26Z")

</div>

Hi

I am trying to setup filebeat with kubernetes so all the logs of the pods in all the different namespaces get sent to elasticsearch. But I would like different indexes for every app. That is why I use the %{[kubernetes.labels.app]} in the elastic output configuration. This works, but when i check the index management all new indexes have lifecycle errors.  
Is there a way to automatically create lifecycles for every app in this way of is a different approach needed

```
filebeat.autodiscover:
  providers:
    - type: kubernetes
      host: ${NODE_NAME}
      hints.enabled: true
      hints.default_config:
        type: container
        paths:
          - /var/log/containers/*${data.kubernetes.container.id}.log

processors:
  - add_cloud_metadata:
  - add_host_metadata:
  - add_kubernetes_metadata:

cloud.id: ${ELASTIC_CLOUD_ID}
cloud.auth: ${ELASTIC_CLOUD_AUTH}

output.elasticsearch:
  hosts: ['${ELASTICSEARCH_HOST:elasticsearch}:${ELASTICSEARCH_PORT:9200}']
  username: ${ELASTICSEARCH_USERNAME}
  password: ${ELASTICSEARCH_PASSWORD}
  indices:
    - index: "filebeat-%{[agent.version]}-%{[kubernetes.labels.app]}-%{+yyyy-MM-dd}"
      when.and:
        - not.equals:
            kubernetes.namespace: "kube-system"
        - not.equals:
            kubernetes.namespace: "default"
        - not.equals:
            kubernetes.namespace: "cert-manager"
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 13, 2019, 6:28am UTC](https://discuss.elastic.co/t/kubernetes-autodiscover-indices/203752/2 "2019-11-13T06:28:22Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.