filebeat.yml config file for filebeat as DaemonSet

filebeat.yml

filebeat.registry_file: /var/log/filebeat.registry

logging.level: ${LOG_LEVEL:error}

# if you want cloud metadata included in your elastic
processors:
- add_cloud_metadata:

fields_under_root: true
fields:
  program: filebeat_k8s
  hostname: ${FILEBEAT_HOST:${HOSTNAME}}

filebeat.prospectors:
  - input_type: log
    paths:
      - /var/log/containers/*.log
    symlinks: true
    tail_files: true
    json.message_key: log
    json.keys_under_root: true
    json.add_error_key: true
    multiline.pattern: '^[[:space:]]'
    multiline.match: after

output.logstash:
  hosts: [ "${LOGSTASH_HOST}:${LOGSTASH_PORT}" ]
  ssl.enabled: true
  ssl.certificate_authorities: ["/etc/ssl/cacert"]
  ssl.certificate: "/etc/ssl/cert"
  ssl.key: "/etc/ssl/key"
  ssl.key_passphrase: "password"
  ssl.verification_mode: full
  ssl.supported_protocols: [TLSv1.1, TLSv1.2]