Can you tell to filter event based on a namespace?
I need to remove all event on kube-system namespace which has string "INFO" on key log.
For reference below is the reference
{
"_index": "logstash-2021.06.23",
"_type": "_doc",
"_id": "s2hwN3oB72jfr9DdcfTG",
"_version": 1,
"_score": null,
"_source": {
"log": "2021-06-23T05:55:53.034Z [INFO]
10.2.1.222:51479 - 24104 \"AAAA IN daas-alh.daas.svc.cluster.local. udp 49 false 512\" NOERROR qr,rd 142 0.000066921s\n",
"stream": "stdout",
}
}
I have used @type grep but did not worked