title: Filebeat Kubernetes Processor and filtering
body: <p>I am trying to ship my K8s pod logs to Elasticsearch using Filebeat.</p>
  
  <p>I am following the guide online here: <a href="https://www.elastic.co/guide/en/beats/filebeat/6.0/running-on-kubernetes.html" rel="nofollow noreferrer">https://www.elastic.co/guide/en/beats/filebeat/6.0/running-on-kubernetes.html</a></p>
  
  <p>Everything works as expected however I want to filter out events from system pods. My updated config looks like:</p>
  
  <pre><code>apiVersion: v1
  kind: ConfigMap
  metadata:
    name: filebeat-prospectors
    namespace: kube-system
    labels:
      k8s-app: filebeat
      kubernetes.io/cluster-service: "true"
  data:
    kubernetes.yml: |-
      - type: log
        paths:
          - /var/lib/docker/containers/*/*.log
    multiline.pattern: '^\s'
    multiline.match: after
    json.message_key: log
    json.keys_under_root: true
    processors:
      - add_kubernetes_metadata:
          in_cluster: true
          namespace: ${POD_NAMESPACE}
      - drop_event.when.regexp:
          or:
            kubernetes.pod.name: "weave-net.*"
            kubernetes.pod.name: "external-dns.*"
            kubernetes.pod.name: "nginx-ingress-controller.*"
            kubernetes.pod.name: "filebeat.*"
  </code></pre>
  
  <p>I am trying to ignore <code>weave-net</code>, <code>external-dns</code>, <code>ingress-controller</code> and <code>filebeat</code> events via:</p>
  
  <pre><code>- drop_event.when.regexp:
      or:
        kubernetes.pod.name: "weave-net.*"
        kubernetes.pod.name: "external-dns.*"
        kubernetes.pod.name: "nginx-ingress-controller.*"
        kubernetes.pod.name: "filebeat.*"
  </code></pre>
  
  <p>However they continue to arrive in Elasticsearch.</p>