1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980 |
- ---
- kind: ConfigMap
- apiVersion: v1
- metadata:
- name: logstash-config
- namespace: qa
- data:
- logstash-config-named-k8s: |
- input {
- beats {
- port => 5044
- }
- }
-
- filter {
- grok {
- match => ["message", "(?<timestamp>%{MONTHDAY}-%{MONTH}-%{YEAR} %{TIME}) queries: client %{IPV4:c_ip}#%{NUMBER:c_port}: query: %{NOTSPACE:queryrec} %{NOTSPACE:dnsclass} %{NOTSPACE:dnstype} \+ \(%{IPV4:dnsbind}\)"]
- }
- }
- output {
- #stdout { codec => rubydebug }
- elasticsearch {
- hosts => ["elasticsearch:9200"]
- index => "logstash-filebeat-%{+YYYY.MM.dd}"
- }
- }
- ---
- kind: Deployment
- apiVersion: apps/v1
- metadata:
- name: logstash-k8s-named
- namespace: qa
- labels:
- app: logstash-k8s-named
- spec:
- replicas: 1
- selector:
- matchLabels:
- app: logstash-k8s-named
- template:
- metadata:
- labels:
- app: logstash-k8s-named
- spec:
- containers:
- - name: logstash-k8s-named
- image: logstash:7.6.2
- command: ["/bin/sh","-c"]
- args: ["/usr/share/logstash/bin/logstash -f /usr/share/logstash/config/indexer-kafka-named-k8s.conf"]
- ports:
- - containerPort: 5044
- name: client
- protocol: TCP
- volumeMounts:
- - name: vm-config
- mountPath: /usr/share/logstash/config
- volumes:
- - name: vm-config
- configMap:
- name: logstash-config
- items:
- - key: logstash-config-named-k8s
- path: indexer-kafka-named-k8s.conf
- ---
- kind: Service
- apiVersion: v1
- metadata:
- labels:
- app: logstash
- name: logstash
- namespace: qa
- spec:
- ports:
- - port: 5044
- name: client1
- nodePort: 30005
- selector:
- app: logstash
- type: NodePort
|