<p>So I wanted to fetch logs from a specific namespace and send them to opensearch, so I didn't get a clue so I decided to try to make it like this:</p>
<pre><code>apiVersion: v1
kind: ConfigMap
metadata:
  labels:
    k8s-app: fluentd-logging
  name: simple-fluentd-configmap
  namespace: fluent-log
data:
  fluent.conf: |
    &lt;match fluent.**&gt;  
      @type null   
    &lt;/match&gt;     
    &lt;source&gt; 
      @type tail
      path /var/log/pods/containers*.log
      pos_file /var/log/containers.pos
      format none
    &lt;filter **&gt;
        @type record_modifier
        remove_keys &quot;container_id,source&quot;
        @type parser
        key_name log
        hash_value_field log
        &lt;parse&gt;
          @type json
        &lt;/parse&gt;
    &lt;/filter&gt;
    &lt;match kubernetes.var.log.containers.**access**.log&gt;
    @type opensearch
    port 443
    logstash_format false
    scheme https
    ssl_verify false
    &lt;/match&gt;
    &lt;match kubernetes.var.log.containers.**balance**.log&gt;
    @type opensearch
    port 443
    logstash_format false
    scheme https
    ssl_verify false
    &lt;/match&gt;
</code></pre>
<p>So the question is how to make it send specific logs based on namespace from kubernetes?</p>

<p>The second match clause in your configuration (the one starting with <code>kubernetes.var.log...</code>) should contain the namespace, and therefore you can filter based on specific namespaces and decide how to handle those specific logs.</p>
<p>If, for any reason, the log path in your cluster does not contain the namespace in its path, you can also use the <a href="https://github.com/fabric8io/fluent-plugin-kubernetes" rel="nofollow noreferrer">kubernetes</a> plugin.<br />
It will enrich your logs with metadata relevant to the cluster, and allow you to extract the namespace logs originated from and deal with them accordingly.</p>
