apiVersion: v1 kind: ConfigMap metadata: name: logstash-configmap data: logstash.yml: | http.host: "0.0.0.0" path.config: /usr/share/logstash/pipeline logstash.conf: | # all input will come from filebeat, no local logs input { kafka { enable_auto_commit => true auto_commit_interval_ms => "1000" bootstrap_servers => "kafka-1-ip-service:9092,kafka-2-ip-service:9092,kafka-3-ip-service:9092" topics => ["pscm-release"] codec => json #type => ["pscm-release"] } } # filter { # if [fields][pod_deploy_name] != "" { # mutate { # #add_field => ["[fields][pod_namespace]","%{[fields][pod_deploy_name]}"] # add_field => { "namespace" => "%{[fields][pod_namespace]}" } # add_field => { "deployment" => "%{[fields][pod_deploy_name]}" } # } # } # } output { stdout{ codec=>rubydebug} if [fields][pod_namespace] =~ "logging" { elasticsearch { hosts => ["elasticsearch:9200"] index => "%{[fields][pod_namespace]}-s-%{+YYYY.MM.dd}" } } else { elasticsearch { hosts => ["elasticsearch:9200"] index => "no-index-%{+YYYY.MM.dd}" } } }