--- kind: ConfigMap apiVersion: v1 metadata: name: logstash-config namespace: qa data: logstash-config-named-k8s: | input { beats { port => 5044 } } filter { grok { match => ["message", "(?%{MONTHDAY}-%{MONTH}-%{YEAR} %{TIME}) queries: client %{IPV4:c_ip}#%{NUMBER:c_port}: query: %{NOTSPACE:queryrec} %{NOTSPACE:dnsclass} %{NOTSPACE:dnstype} \+ \(%{IPV4:dnsbind}\)"] } } output { #stdout { codec => rubydebug } elasticsearch { hosts => ["elasticsearch:9200"] index => "logstash-filebeat-%{+YYYY.MM.dd}" } } --- kind: Deployment apiVersion: apps/v1 metadata: name: logstash-k8s-named namespace: qa labels: app: logstash-k8s-named spec: replicas: 1 selector: matchLabels: app: logstash-k8s-named template: metadata: labels: app: logstash-k8s-named spec: containers: - name: logstash-k8s-named image: dockerhub-pr.yeshj.com/ops/logstash:7.6.2 command: ["/bin/sh","-c"] args: ["/usr/share/logstash/bin/logstash -f /usr/share/logstash/config/indexer-kafka-named-k8s.conf"] volumeMounts: - name: vm-config mountPath: /usr/share/logstash/config imagePullSecrets: - name: regcred-elastic volumes: - name: vm-config configMap: name: logstash-config items: - key: logstash-config-named-k8s path: indexer-kafka-named-k8s.conf