hi, used kubernetes provider for filebeat.and get %{[kubernetes.namespace]} for index ,but in documents for special namespace i see other namespace logs and filed log.file.path is incorrect.
In fact, in an index related to a namespace, the report of other namespaces can be seen
{
**"_index": ".ds-1w-sre-argocd-2024.07.26-000007",**
"_id": "1hLj9ZABrJHZmRLzMiNK",
"_version": 1,
"_score": 0,
"_source": {
"@timestamp": "2024-07-27T20:30:24.156Z",
"log": {
"offset": 949818,
"file": {
**"path": "/var/log/containers/redis-clasor01-node-1_technical-bigdata-redissen-clasor01_redis-ad68c1b60305487792855be8eb0bb384aa734ae5e46815b528821f1b6f43889b.log"**
}
},
"message": "1:S 27 Jul 2024 20:30:24.156 * Connecting to MASTER redis-khanemobile01-node-1.redis-khanemobile01-headless.technical-bigdata-redissen-khanemobile01.svc.cluster.local:6379",
"input": {
"type": "container"
},
"kubernetes": {
"replicaset": {
"name": "argocd-server-8665fc545f"
},
"pod": {
"name": "argocd-server-8665fc545f-vhjwm",
"uid": "6092bddd-272c-4131-adcd-e1b51292b110",
"ip": "192.168.29.193"
},
"deployment": {
"name": "argocd-server"
},
"labels": {
"app_kubernetes_io/name": "argocd-server",
"app_kubernetes_io/part-of": "argocd",
"app_kubernetes_io/version": "v2.8.4",
"helm_sh/chart": "argo-cd-5.46.7",
"pod-template-hash": "8665fc545f",
"app_kubernetes_io/component": "server",
"app_kubernetes_io/instance": "argocd",
"app_kubernetes_io/managed-by": "Helm"
},
"namespace_uid": "eccb8265-efae-48e5-ad85-616717c4fb87",
**"namespace": "argocd",**
"node": {
"name": "opkbwfpskst0107",
"uid": "b6b04533-2097-455f-ab51-71e10dccff64",
"labels": {
"beta_kubernetes_io/arch": "amd64",
"beta_kubernetes_io/os": "linux",
"clasor": "docs",
"kubernetes_io/arch": "amd64",
"kubernetes_io/hostname": "opkbwfpskst0107",
"kubernetes_io/os": "linux"
},
.
.
.
this is my configuration filebeats:
apiVersion: v1
kind: ConfigMap
metadata:
name: filebeat-config
namespace: kube-logging
labels:
k8s-app: filebeat
data:
filebeat.yml: |-
filebeat.autodiscover:
providers:
- type: kubernetes
host: ${HOSTNAME}
hints.enabled: true
hints.default_config:
type: container
paths:
- /var/log/containers/*${data.kubernetes.container.id}.log
processors:
- add_host_metadata:
- add_kubernetes_metadata:
output.elasticsearch:
hosts: ['${ELASTICSEARCH_HOST:"x.x.x.x"}:${ELASTICSEARCH_PORT:"9200"}']
username: sre
password: S8r6E4
index: "1w-sre-%{[kubernetes.namespace]}"
protocol: "http"
ssl.verification_mode: "none"
setup.template:
name: '1w-sre'
pattern: '1w-sre-*'
enabled: false
setup.ilm.enabled: false
logging.level: debug
Any idea what I make wrong?