<p>I'm trying to limit my filebeat daemonset to collect logs only from certain namespaces.</p>
<p>According to the <a href="https://www.elastic.co/guide/en/beats/filebeat/current/configuration-autodiscover.html#_kubernetes" rel="nofollow noreferrer">official autodiscovery documentation</a>, I can define <code>namespace:</code> but it seems to be singular, not plural.</p>
<p>Is there anyway to limit the namespace but for several namespaces?</p>
<p>My current configuration looks like this:</p>
<pre><code>filebeat.autodiscover:
  providers:
    - type: kubernetes
      node: ${NODE_NAME}
      namespace: backend
      hints.enabled: true
      hints.default_config:
        type: container
        paths:
          - /var/log/containers/*-${data.kubernetes.container.id}.log
      include_annotations: '*'
</code></pre>

<p>After some reading it looks that you can achieve your goal with <a href="https://www.elastic.co/guide/en/beats/filebeat/current/configuration-autodiscover-hints.html#configuration-autodiscover-hints" rel="nofollow noreferrer">Hints based autodiscover</a>:</p>
<p>The hints system looks for hints in Kubernetes Pod annotations or Docker labels that have the prefix <code>co.elastic.logs</code>. As soon as the container starts, Filebeat will check if it contains any hints and launch the proper config for it. Hints tell Filebeat how to get logs for the given container.</p>
<p>So basically you enable the hints in your main configuration:</p>
<pre class="lang-yaml prettyprint-override"><code>filebeat.autodiscover:
  providers:
    - type: kubernetes
      hints.enabled: true
      add_resource_metadata.namespace.enabled: true
      hints.default_config.enabled: false
</code></pre>
<p>Then you can provide the hint for it in form of annotation:</p>
<pre class="lang-yaml prettyprint-override"><code>annotations:
  co.elastic.logs/enabled: 'true'
</code></pre>
