<p>I have a filebeat outside of the kubernetes cluster, installed as an application on the host. I want to ignore two namespaces in filebeat, since they are very large and I don't need them within elastichsearch.  </p>

<p>Here is my input definition in filebeat.yml:  </p>

<pre><code>- type: log
  enabled: true
  paths:
    - /var/lib/docker/containers/*/*.log
  json.message_key: log
  json.keys_under_root: true
  processors:
    - add_kubernetes_metadata:
        in_cluster: false
        host: main-backend
        kube_config: /etc/kubernetes/admin.conf
    - drop_event.when.regexp:
        or:
          - kubernetes.namespace: "kube-system"
          - kubernetes.namespace: "monitoring"
</code></pre>

<p>However, I still see a lot of log from those namespaces within my elasticsearch. Is there any way to debug it why is it happening?  </p>

<p>Can you try as given below</p>

<pre><code>- drop_event:
          when:
            or:
            - not:
                equals:
                  kubernetes.namespace: "kube-system"
            - not:
                equals:
                  kubernetes.namespace: "monitoring"
            - regexp:
                kubernetes.pod.name: "filebeat-*"
            - regexp:
                kubernetes.pod.name: "elasticsearch-*" 
</code></pre>
