<p>I am using elasticserach 6.8 and filebeat 6.8.0 in a Kubernetes cluster. I want filebeat to ignore certain container logs but it seems almost impossible :).</p>

<p>This is my autodiscover config</p>

<pre><code>filebeat.autodiscover:
  providers:
   - type: kubernetes
     hints.enabled: true
     templates:
      - condition:
        contains:
          kubernetes.namespace: bagmessage
        config:
         - type: docker
           containers.ids:
             - "${data.kubernetes.container.id}"
           processors:
             - drop_event:
                 when:
                   or: 
                     - contains:
                         kubernetes.container.name: "filebeat"
                     - contains:
                         kubernetes.container.name: "weave-npc"
                     - contains:
                         kubernetes.container.name: "bag-fluentd-es"
                     - contains:
                         kubernetes.container.name: "logstash"
                     - contains:
                         kubernetes.container.name: "billing"
</code></pre>

<p>I've tried many variations of this configuration but still filebeats is processing container logs that I want it to ignore.</p>

<p>I'd like to know if what I want to do is possible and if so, what am I doing wrong?</p>

<p>Thanks</p>

SME
<p>The first error I see in your config is incorrect indentation of the <code>condition</code> section in the <code>template</code>. Should be:</p>
<pre><code>   - type: kubernetes
     hints.enabled: true
     templates:
       - condition:
           contains:
             kubernetes.namespace: bagmessage
</code></pre>
<p>Secondly, I'm not sure the <code>kubernetes.*</code> is visible to the processors inside the config with <code>type: docker</code>. You may try to reference <code>docker.container.name</code> instead. Or alternatively you can move all your k8s-specific conditions to the <code>condition</code> section under the <code>templates</code>:</p>
<pre><code>filebeat.autodiscover:
  providers:
    - type: kubernetes
      hints.enabled: true
      templates:
        - condition:
            and:
              - contains.kubernetes.namespace: bagmessage
              - contains.container.name: billing
          config:
              ...
</code></pre>
<p>Also, make sure that &quot;container.name&quot; (but not &quot;pod.name&quot;) is indeed what you want.</p>
