deploy-tmp-logstash.yaml 1.8 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384
  1. ---
  2. kind: ConfigMap
  3. apiVersion: v1
  4. metadata:
  5. name: logstash-config
  6. namespace: qa
  7. data:
  8. logstash-config-named-k8s: |
  9. input {
  10. beats {
  11. port => 5044
  12. }
  13. }
  14. filter {
  15. grok {
  16. match => ["message", "(?<timestamp>%{MONTHDAY}-%{MONTH}-%{YEAR} %{TIME}) queries: client %{IPV4:c_ip}#%{NUMBER:c_port}: query: %{NOTSPACE:queryrec} %{NOTSPACE:dnsclass} %{NOTSPACE:dnstype} \+ \(%{IPV4:dnsbind}\)"]
  17. }
  18. }
  19. output {
  20. #stdout { codec => rubydebug }
  21. elasticsearch {
  22. hosts => ["elasticsearch:9200"]
  23. index => "logstash-filebeat-%{+YYYY.MM.dd}"
  24. }
  25. }
  26. logstash_yml: |
  27. http.host: "0.0.0.0"
  28. ---
  29. kind: Deployment
  30. apiVersion: apps/v1
  31. metadata:
  32. name: logstash-k8s-named
  33. namespace: qa
  34. labels:
  35. app: logstash-k8s-named
  36. spec:
  37. replicas: 1
  38. selector:
  39. matchLabels:
  40. app: logstash-k8s-named
  41. template:
  42. metadata:
  43. labels:
  44. app: logstash-k8s-named
  45. spec:
  46. containers:
  47. - name: logstash-k8s-named
  48. image: logstash:7.6.2
  49. command: ["/bin/sh","-c"]
  50. args: ["/usr/share/logstash/bin/logstash -f /usr/share/logstash/config/logstash.conf"]
  51. ports:
  52. - containerPort: 5044
  53. name: client
  54. protocol: TCP
  55. volumeMounts:
  56. - name: vm-config
  57. mountPath: /usr/share/logstash/config
  58. volumes:
  59. - name: vm-config
  60. configMap:
  61. name: logstash-config
  62. items:
  63. - key: logstash-config-named-k8s
  64. path: logstash.conf
  65. - key: logstash_yml
  66. path: logstash.yml
  67. ---
  68. kind: Service
  69. apiVersion: v1
  70. metadata:
  71. labels:
  72. app: logstash
  73. name: logstash
  74. namespace: qa
  75. spec:
  76. ports:
  77. - port: 5044
  78. name: client1
  79. nodePort: 30005
  80. selector:
  81. app: logstash
  82. type: NodePort