Not able to remove event with filters

13 views
Skip to first unread message

koushick patel

unread,
Jun 23, 2021, 5:05:20 AM6/23/21
to Fluentd Google Group
Can you tell to filter event based on a namespace?

I need to remove all event on kube-system namespace which has string "INFO" on key log.

For reference below is the reference

{
  "_index": "logstash-2021.06.23",
  "_type": "_doc",
  "_id": "s2hwN3oB72jfr9DdcfTG",
  "_version": 1,
  "_score": null,
  "_source": {
    "log": "2021-06-23T05:55:53.034Z [INFO] 10.2.1.222:51479 - 24104 \"AAAA IN daas-alh.daas.svc.cluster.local. udp 49 false 512\" NOERROR qr,rd 142 0.000066921s\n",
    "stream": "stdout",
}
}



I have used @type grep but did not worked

Reply all
Reply to author
Forward
0 new messages