1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283 |
- ---
- kind: ConfigMap
- apiVersion: v1
- metadata:
- name: logstash-config
- namespace: qa
- data:
- logstash-config-named-k8s: |
- input {
- tcp {
- port => 5000
- }
- }
-
- filter {
- grok {
- match => ["message", "(?<timestamp>%{MONTHDAY}-%{MONTH}-%{YEAR} %{TIME}) queries: client %{IPV4:c_ip}#%{NUMBER:c_port}: query: %{NOTSPACE:queryrec} %{NOTSPACE:dnsclass} %{NOTSPACE:dnstype} \+ \(%{IPV4:dnsbind}\)"]
- }
- }
- output {
- #stdout { codec => rubydebug }
- elasticsearch {
- hosts => ["elasticsearch:9200"]
- index => "logstash-filebeat-%{+YYYY.MM.dd}"
- }
- }
- logstash_yml: |
- http.host: "0.0.0.0"
- ---
- kind: Deployment
- apiVersion: apps/v1
- metadata:
- name: logstash-k8s-named
- namespace: qa
- labels:
- app: logstash-k8s-named
- spec:
- replicas: 1
- selector:
- matchLabels:
- app: logstash-k8s-named
- template:
- metadata:
- labels:
- app: logstash-k8s-named
- spec:
- containers:
- - name: logstash-k8s-named
- image: logstash:7.6.2
- command: ["/bin/sh","-c"]
- args: ["/usr/share/logstash/bin/logstash -f /usr/share/logstash/config/logstash.conf"]
- ports:
- - containerPort: 5000
- name: client1
- - containerPort: 9600
- name: api
- volumeMounts:
- - name: vm-config
- mountPath: /usr/share/logstash/config
- volumes:
- - name: vm-config
- configMap:
- name: logstash-config
- items:
- - key: logstash-config-named-k8s
- path: logstash.conf
- ---
- kind: Service
- apiVersion: v1
- metadata:
- labels:
- app: logstash
- name: logstash
- namespace: qa
- spec:
- ports:
- - name: http
- port: 5000
- protocol: TCP
- targetPort: 5000
- selector:
- app: logstash
|