diff --git a/controllers/logging_controller_match_test.go b/controllers/logging_controller_match_test.go
index 1c0c43cd3..3591ce277 100644
--- a/controllers/logging_controller_match_test.go
+++ b/controllers/logging_controller_match_test.go
@@ -18,11 +18,143 @@ import (
 	"fmt"
 	"testing"
 
+	"github.com/MakeNowJust/heredoc"
+	"github.com/andreyvit/diff"
+	"github.com/banzaicloud/logging-operator/pkg/resources/fluentd"
 	"github.com/banzaicloud/logging-operator/pkg/sdk/api/v1beta1"
 	"github.com/banzaicloud/operator-tools/pkg/utils"
+	"github.com/onsi/gomega"
+	corev1 "k8s.io/api/core/v1"
 	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 )
 
+func TestFlowMatch(t *testing.T) {
+	g := gomega.NewGomegaWithT(t)
+	defer beforeEach(t)()
+
+	logging := testLogging()
+	output := testOutput()
+
+	flow := &v1beta1.Flow{
+		ObjectMeta: v1.ObjectMeta{
+			Name:      "test-flow",
+			Namespace: output.Namespace,
+		},
+		Spec: v1beta1.FlowSpec{
+			Match: []v1beta1.Match{
+				{
+					Select: &v1beta1.Select{
+						Labels: map[string]string{
+							"c": "d",
+						},
+					},
+				},
+			},
+			OutputRefs: []string{output.Name},
+		},
+	}
+
+	defer ensureCreated(t, logging)()
+	defer ensureCreated(t, output)()
+	defer ensureCreated(t, flow)()
+
+	secret := &corev1.Secret{}
+	defer ensureCreatedEventually(t, controlNamespace, logging.QualifiedName(fluentd.AppSecretConfigName), secret)()
+
+	g.Expect(diff.TrimLinesInString(string(secret.Data[fluentd.AppConfigKey]))).Should(gomega.ContainSubstring(diff.TrimLinesInString(heredoc.Docf(`
+		<match>
+		  labels c:d
+		  namespaces %s
+		  negate false
+		</match>
+	`, flow.Namespace))))
+}
+
+func TestClusterFlowMatch(t *testing.T) {
+	g := gomega.NewGomegaWithT(t)
+	defer beforeEach(t)()
+
+	logging := testLogging()
+	output := testClusterOutput()
+
+	flow := &v1beta1.ClusterFlow{
+		ObjectMeta: v1.ObjectMeta{
+			Name:      "test-flow",
+			Namespace: logging.Spec.ControlNamespace,
+		},
+		Spec: v1beta1.ClusterFlowSpec{
+			Match: []v1beta1.ClusterMatch{
+				{
+					ClusterSelect: &v1beta1.ClusterSelect{
+						Labels: map[string]string{
+							"c": "d",
+						},
+					},
+				},
+			},
+			OutputRefs: []string{output.Name},
+		},
+	}
+
+	defer ensureCreated(t, logging)()
+	defer ensureCreated(t, output)()
+	defer ensureCreated(t, flow)()
+
+	secret := &corev1.Secret{}
+	defer ensureCreatedEventually(t, controlNamespace, logging.QualifiedName(fluentd.AppSecretConfigName), secret)()
+
+	g.Expect(diff.TrimLinesInString(string(secret.Data[fluentd.AppConfigKey]))).Should(gomega.ContainSubstring(diff.TrimLinesInString(heredoc.Docf(`
+		<match>
+		  labels c:d
+		  namespaces
+		  negate false
+		</match>
+	`))))
+}
+
+func TestClusterFlowMatchWithNamespaces(t *testing.T) {
+	g := gomega.NewGomegaWithT(t)
+	defer beforeEach(t)()
+
+	logging := testLogging()
+	output := testClusterOutput()
+
+	flow := &v1beta1.ClusterFlow{
+		ObjectMeta: v1.ObjectMeta{
+			Name:      "test-flow",
+			Namespace: logging.Spec.ControlNamespace,
+		},
+		Spec: v1beta1.ClusterFlowSpec{
+			Match: []v1beta1.ClusterMatch{
+				{
+					ClusterSelect: &v1beta1.ClusterSelect{
+						Labels: map[string]string{
+							"c": "d",
+						},
+						Namespaces: []string{"a", "b"},
+					},
+				},
+			},
+			OutputRefs: []string{output.Name},
+		},
+	}
+
+	defer ensureCreated(t, logging)()
+	defer ensureCreated(t, output)()
+	defer ensureCreated(t, flow)()
+
+	secret := &corev1.Secret{}
+	defer ensureCreatedEventually(t, controlNamespace, logging.QualifiedName(fluentd.AppSecretConfigName), secret)()
+
+	g.Expect(diff.TrimLinesInString(string(secret.Data[fluentd.AppConfigKey]))).Should(gomega.ContainSubstring(diff.TrimLinesInString(heredoc.Docf(`
+		<match>
+		  labels c:d
+		  namespaces a,b
+		  negate false
+		</match>
+	`))))
+}
+
 func TestInvalidFlowIfMatchAndSelectorBothSet(t *testing.T) {
 	defer beforeEach(t)()
 
diff --git a/controllers/logging_controller_test.go b/controllers/logging_controller_test.go
index 4760a4e6c..dd15306b5 100644
--- a/controllers/logging_controller_test.go
+++ b/controllers/logging_controller_test.go
@@ -551,7 +551,6 @@ func ensureCreatedEventually(t *testing.T, ns, name string, object runtime.Objec
 	}
 }
 
-
 func expectError(t *testing.T, expected string) {
 	err := wait.Poll(time.Second, time.Second*3, func() (bool, error) {
 		select {
@@ -583,6 +582,20 @@ func testOutput() *v1beta1.Output {
 	}
 }
 
+func testClusterOutput() *v1beta1.ClusterOutput {
+	return &v1beta1.ClusterOutput{
+		ObjectMeta: v1.ObjectMeta{
+			Name:      "test-output",
+			Namespace: controlNamespace,
+		},
+		Spec: v1beta1.ClusterOutputSpec{
+			OutputSpec: v1beta1.OutputSpec{
+				NullOutputConfig: output.NewNullOutputConfig(),
+			},
+		},
+	}
+}
+
 func testLogging() *v1beta1.Logging {
 	return &v1beta1.Logging{
 		ObjectMeta: v1.ObjectMeta{
diff --git a/go.mod b/go.mod
index 542d45b32..f29cfab03 100644
--- a/go.mod
+++ b/go.mod
@@ -5,6 +5,7 @@ go 1.12
 require (
 	emperror.dev/errors v0.7.0
 	github.com/MakeNowJust/heredoc v1.0.0
+	github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883
 	github.com/banzaicloud/logging-operator/pkg/sdk v0.0.0
 	github.com/banzaicloud/operator-tools v0.8.0
 	github.com/coreos/prometheus-operator v0.34.0