Unable to get namespace as index name

Elastic Stack Logstash
1

Hi Guys,

Requirement : Have INDEX name as FILEBEAT-NAMESPACE-YYYYMMDD

Issue: I am unable to get NAMESPACE resolved to be the kubernetes namespace, with whatever option I try.

Application: Logstash 7.4.1 is deployed using Kubernetes.
Following is how logstash.yml look like:

logstashPipeline:
  logstash.conf: |
    input {
       beats {
         port => 5044
       }
    }
    output {
      elasticsearch {
        hosts => ["https://elasticsearch-master:9200"]
        manage_template => false
        index => "%{[@metadata][beat]}-%{[attrs][container.labels.io_kubernetes_pod_namespace]}-%{+YYYY.MM.dd}"
        document_type => "%{[@metadata][type]}"
      }
    }

Issue: Index name is coming as filebeat-%{[attrs][container.labels.io_kubernetes_pod_namespace]}-2019.12.12, whereas expected as "filebeat-NAMESPACE-2019.12.12.

Any suggestions please?

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.