k8s/fklek/6.x/logstash-cm.yaml

apiVersion: v1
kind: ConfigMap
metadata:
  name: logstash-configmap
data:
  logstash.yml: |
    http.host: "0.0.0.0"
    path.config: /usr/share/logstash/pipeline
  logstash.conf: |
    # all input will come from filebeat, no local logs
    input {
      kafka {
              enable_auto_commit => true
              auto_commit_interval_ms => "1000"
              bootstrap_servers => "kafka-1-ip-service:9092,kafka-2-ip-service:9092,kafka-3-ip-service:9092"
              topics => ["pscm-release"]
              codec => json
              #type => ["pscm-release"]
          }
    }
#    filter {
#      if [fields][pod_deploy_name] != "" {
#          mutate {
#             #add_field => ["[fields][pod_namespace]","%{[fields][pod_deploy_name]}"]
#             add_field => { "namespace" => "%{[fields][pod_namespace]}" }
#             add_field => { "deployment" => "%{[fields][pod_deploy_name]}" }
#        }
#      }
#    }

    output {
       stdout{ codec=>rubydebug}
       if [fields][pod_namespace] =~ "logging" {
           elasticsearch {
             hosts => ["elasticsearch:9200"]
             index => "%{[fields][pod_namespace]}-s-%{+YYYY.MM.dd}"
          }
       } else {
          elasticsearch {
             hosts => ["elasticsearch:9200"]
             index => "no-index-%{+YYYY.MM.dd}"
          }
       }
    }