Filebeat in kubernetes

filebeat.yml

filebeat.inputs:                                                                                                    
- type: container                                                                                                   
  paths:                                                                                                            
    - /var/log/containers/*.log                                                                                     
  processors:                                                                                                       
  - add_kubernetes_metadata:                                                                                      
        in_cluster: true                                                                                            
        host: ${NODE_NAME}                                                                                          
        matchers:                                                                                                   
        - logs_path:                                                                                                
            logs_path: "/var/log/containers/"                                                                       
  - decode_json_fields:                                                                                           
        when:                                                                                                     
          and:                                                                                                    
            - regexp:                                                                                             
                message: ' *\{.*\} *'                                                                             
            - equals:                                                                                             
                "kubernetes.container.name": nginx-ingress-controller                                             
        fields: ["message"]                                                                                       
        max_depth: 1                                                                                              
        target: ""                                                                                                
        overwrite_keys: true                                                                                      
        add_error_key: true 

output.elasticsearch:                                                                                               
  hosts: ['elasticsearch.services:9200']                                                                            
  protocol: http