--- kind: ConfigMap apiVersion: v1 metadata: name: logstash-config namespace: qa data: logstash-config-named-k8s: | input { beats { port => 5044 } } filter { grok { match => ["message", "(?%{MONTHDAY}-%{MONTH}-%{YEAR} %{TIME}) queries: client %{IPV4:c_ip}#%{NUMBER:c_port}: query: %{NOTSPACE:queryrec} %{NOTSPACE:dnsclass} %{NOTSPACE:dnstype} \+ \(%{IPV4:dnsbind}\)"] } } output { #stdout { codec => rubydebug } elasticsearch { hosts => ["elasticsearch:9200"] index => "logstash-filebeat-%{+YYYY.MM.dd}" } } --- kind: Deployment apiVersion: apps/v1 metadata: name: logstash-k8s-named namespace: qa labels: app: logstash-k8s-named spec: replicas: 1 selector: matchLabels: app: logstash-k8s-named template: metadata: labels: app: logstash-k8s-named spec: containers: - name: logstash-k8s-named image: logstash:7.6.2 command: ["/bin/sh","-c"] args: ["/usr/share/logstash/bin/logstash -f /usr/share/logstash/config/indexer-kafka-named-k8s.conf"] ports: - containerPort: 5044 name: client protocol: TCP volumeMounts: - name: vm-config mountPath: /usr/share/logstash/config volumes: - name: vm-config configMap: name: logstash-config items: - key: logstash-config-named-k8s path: indexer-kafka-named-k8s.conf --- kind: Service apiVersion: v1 metadata: labels: app: logstash name: logstash namespace: qa spec: ports: - port: 5044 name: client1 nodePort: 30005 selector: app: logstash type: NodePort