Part of the indices are created with this name "%{[kubernetes][namespace]}"

Look at the documents in that index. Do any of them have a field called [kubernetes][namespace]? If not, that is what causes them to be named that way.

The indentation of the second processors: option looks wrong to me, and yaml is notoriously picky about indentation. In fact the existence of a second processors: option looks wrong.