|
@@ -0,0 +1,62 @@
|
|
|
+---
|
|
|
+kind: ConfigMap
|
|
|
+apiVersion: v1
|
|
|
+metadata:
|
|
|
+ name: logstash-config
|
|
|
+ namespace: qa
|
|
|
+data:
|
|
|
+ logstash-config-named-k8s: |
|
|
|
+ input {
|
|
|
+ beats {
|
|
|
+ port => 5044
|
|
|
+ }
|
|
|
+ }
|
|
|
+
|
|
|
+ filter {
|
|
|
+ grok {
|
|
|
+ match => ["message", "(?<timestamp>%{MONTHDAY}-%{MONTH}-%{YEAR} %{TIME}) queries: client %{IPV4:c_ip}#%{NUMBER:c_port}: query: %{NOTSPACE:queryrec} %{NOTSPACE:dnsclass} %{NOTSPACE:dnstype} \+ \(%{IPV4:dnsbind}\)"]
|
|
|
+ }
|
|
|
+ }
|
|
|
+
|
|
|
+ output {
|
|
|
+ #stdout { codec => rubydebug }
|
|
|
+ elasticsearch {
|
|
|
+ hosts => ["elasticsearch:9200"]
|
|
|
+ index => "logstash-filebeat-%{+YYYY.MM.dd}"
|
|
|
+ }
|
|
|
+ }
|
|
|
+---
|
|
|
+kind: Deployment
|
|
|
+apiVersion: apps/v1
|
|
|
+metadata:
|
|
|
+ name: logstash-k8s-named
|
|
|
+ namespace: qa
|
|
|
+ labels:
|
|
|
+ app: logstash-k8s-named
|
|
|
+spec:
|
|
|
+ replicas: 1
|
|
|
+ selector:
|
|
|
+ matchLabels:
|
|
|
+ app: logstash-k8s-named
|
|
|
+ template:
|
|
|
+ metadata:
|
|
|
+ labels:
|
|
|
+ app: logstash-k8s-named
|
|
|
+ spec:
|
|
|
+ containers:
|
|
|
+ - name: logstash-k8s-named
|
|
|
+ image: dockerhub-pr.yeshj.com/ops/logstash:7.6.2
|
|
|
+ command: ["/bin/sh","-c"]
|
|
|
+ args: ["/usr/share/logstash/bin/logstash -f /usr/share/logstash/config/indexer-kafka-named-k8s.conf"]
|
|
|
+ volumeMounts:
|
|
|
+ - name: vm-config
|
|
|
+ mountPath: /usr/share/logstash/config
|
|
|
+ imagePullSecrets:
|
|
|
+ - name: regcred-elastic
|
|
|
+ volumes:
|
|
|
+ - name: vm-config
|
|
|
+ configMap:
|
|
|
+ name: logstash-config
|
|
|
+ items:
|
|
|
+ - key: logstash-config-named-k8s
|
|
|
+ path: indexer-kafka-named-k8s.conf
|