deploy-tmp-logstash.yaml 1.7 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980
  1. ---
  2. kind: ConfigMap
  3. apiVersion: v1
  4. metadata:
  5. name: logstash-config
  6. namespace: qa
  7. data:
  8. logstash-config-named-k8s: |
  9. input {
  10. beats {
  11. port => 5044
  12. }
  13. }
  14. filter {
  15. grok {
  16. match => ["message", "(?<timestamp>%{MONTHDAY}-%{MONTH}-%{YEAR} %{TIME}) queries: client %{IPV4:c_ip}#%{NUMBER:c_port}: query: %{NOTSPACE:queryrec} %{NOTSPACE:dnsclass} %{NOTSPACE:dnstype} \+ \(%{IPV4:dnsbind}\)"]
  17. }
  18. }
  19. output {
  20. #stdout { codec => rubydebug }
  21. elasticsearch {
  22. hosts => ["elasticsearch:9200"]
  23. index => "logstash-filebeat-%{+YYYY.MM.dd}"
  24. }
  25. }
  26. ---
  27. kind: Deployment
  28. apiVersion: apps/v1
  29. metadata:
  30. name: logstash-k8s-named
  31. namespace: qa
  32. labels:
  33. app: logstash-k8s-named
  34. spec:
  35. replicas: 1
  36. selector:
  37. matchLabels:
  38. app: logstash-k8s-named
  39. template:
  40. metadata:
  41. labels:
  42. app: logstash-k8s-named
  43. spec:
  44. containers:
  45. - name: logstash-k8s-named
  46. image: logstash:7.6.2
  47. command: ["/bin/sh","-c"]
  48. args: ["/usr/share/logstash/bin/logstash -f /usr/share/logstash/config/indexer-kafka-named-k8s.conf"]
  49. ports:
  50. - containerPort: 5044
  51. name: client
  52. protocol: TCP
  53. volumeMounts:
  54. - name: vm-config
  55. mountPath: /usr/share/logstash/config
  56. volumes:
  57. - name: vm-config
  58. configMap:
  59. name: logstash-config
  60. items:
  61. - key: logstash-config-named-k8s
  62. path: indexer-kafka-named-k8s.conf
  63. ---
  64. kind: Service
  65. apiVersion: v1
  66. metadata:
  67. labels:
  68. app: logstash
  69. name: logstash
  70. namespace: qa
  71. spec:
  72. ports:
  73. - port: 5044
  74. name: client1
  75. nodePort: 30005
  76. selector:
  77. app: logstash
  78. type: NodePort