How to filter out logs from a given kubernetes namespace

[albrookesplowman]

Please can you help...

Is there a way of filtering out logs from specific namespaces so that they do not get sent to elasticsearch? I have tried configuring the extraConfigMaps section in the values.yaml as below:

extraConfigMaps: containers.input.conf: |- <match kubernetes.var.log.containers.kube-system.log> @type null <match kubernetes.var.log.containers.kube-proxy.log> @type null <match kubernetes.var.log.containers.default.log> @type null <match kubernetes.var.log.containers.kube-public.log> @type null <match kubernetes.var.log.containers.kube-node-lease.log> @type null

But this seems to stop logs from all namespaces.

Do I need to change the configMaps section as well:

configMaps: useDefaults: systemConf: true containersInputConf: true systemInputConf: true forwardInputConf: true monitoringConf: true outputConf: true

and if so, which one do I disable to make it work?

many thanks

Alan

[rgarcia89]

@albrookesplowman works for me like that

# can be used to add new config or overwrite the default configmaps completely after the configmaps default has been disabled above
extraConfigMaps:
  # system.conf: |-
  #   <system>
  #     root_dir /tmp/fluentd-buffers/
  #   </system>
  exclude.conf: |-
    <match kubernetes.var.log.containers.**_test_**>
      @type null
    </match>

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.