deploy-tmp-logstash.yaml 2.0 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687
  1. ---
  2. kind: ConfigMap
  3. apiVersion: v1
  4. metadata:
  5. name: logstash-config
  6. namespace: qa
  7. data:
  8. logstash-config-named-k8s: |
  9. input {
  10. beats {
  11. port => 5000
  12. }
  13. }
  14. filter {
  15. grok {
  16. match => ["message", "(?<timestamp>%{MONTHDAY}-%{MONTH}-%{YEAR} %{TIME}) queries: client %{IPV4:c_ip}#%{NUMBER:c_port}: query: %{NOTSPACE:queryrec} %{NOTSPACE:dnsclass} %{NOTSPACE:dnstype} \+ \(%{IPV4:dnsbind}\)"]
  17. }
  18. }
  19. output {
  20. #stdout { codec => rubydebug }
  21. elasticsearch {
  22. hosts => ["elasticsearch:9200"]
  23. index => "logstash-filebeat-%{+YYYY.MM.dd}"
  24. }
  25. }
  26. logstash_yml: |
  27. http.host: "0.0.0.0"
  28. xpack.monitoring.enabled: true
  29. xpack.monitoring.elasticsearch.hosts: [ "http://elasticsearch:9200" ]
  30. xpack.monitoring.elasticsearch.username: "elastic"
  31. xpack.monitoring.elasticsearch.password: "changme"
  32. ---
  33. kind: Deployment
  34. apiVersion: apps/v1
  35. metadata:
  36. name: logstash-k8s-named
  37. namespace: qa
  38. labels:
  39. app: logstash-k8s-named
  40. spec:
  41. replicas: 1
  42. selector:
  43. matchLabels:
  44. app: logstash-k8s-named
  45. template:
  46. metadata:
  47. labels:
  48. app: logstash-k8s-named
  49. spec:
  50. containers:
  51. - name: logstash-k8s-named
  52. image: logstash:7.6.2
  53. command: ["/bin/sh","-c"]
  54. args: ["/usr/share/logstash/bin/logstash -f /usr/share/logstash/config/logstash.conf"]
  55. ports:
  56. - containerPort: 5000
  57. name: client1
  58. - containerPort: 9600
  59. name: api
  60. volumeMounts:
  61. - name: vm-config
  62. mountPath: /usr/share/logstash/config
  63. volumes:
  64. - name: vm-config
  65. configMap:
  66. name: logstash-config
  67. items:
  68. - key: logstash-config-named-k8s
  69. path: logstash.conf
  70. ---
  71. kind: Service
  72. apiVersion: v1
  73. metadata:
  74. labels:
  75. app: logstash
  76. name: logstash
  77. namespace: qa
  78. spec:
  79. ports:
  80. - name: http
  81. port: 5000
  82. protocol: TCP
  83. targetPort: 5000
  84. selector:
  85. app: logstash