filebeat configmaps

---
apiVersion: v1
kind: ConfigMap
metadata:
  name: filebeat-config
  namespace: kube-system
  labels:
    k8s-app: filebeat
    kubernetes.io/cluster-service: "true"
data:
  filebeat.yml: |-
    filebeat.autodiscover:
      providers:
        - type: kubernetes
          hints.enabled: true
          include_annotations: '*'

    processors:
      - add_cloud_metadata:

    tags: [ 'kubernetes', 'Wendimore', 'EKS-worker-nodes' ]

    xpack.monitoring:
      enabled: true
      elasticsearch:
        hosts: ["<elasticsearch-cluster>:9200"]

    output:
      logstash:
        hosts: ["<elasticsearch-cluster>:5044"]
        ttl: 60
        pipelining: 0
        ssl:
          certificate_authorities: ["/etc/logstash-certs/logstash.crt"]

    shipper:
    logging:
      files:
        rotateeverybytes: 10485760 # = 100MB

k8s deploy snippet

---
apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  creationTimestamp: null
  name: foo-bar
  labels:
    log-type: puma-log
    worker-type: main
    service-type: ruby
spec:
  template:
    metadata:
      labels:
        log-type: puma-log
        worker-type: main
        service-type: ruby
      annotations:
        co.elastic.logs/exclude_lines: 'GET\s"?/status'
        co.elastic.logs/module: 'nginx'
        co.elastic.logs/fileset.stdout: 'access'
      co.elastic.logs/fileset.stderr: 'error'