arslanm

#!/usr/bin/env python2.7
#
# This script cancels long running searches on Elasticsearch.
# Tested on 5.6 but should work with all versions above 5.1 (which introduced Task API).

# Search task duration in seconds to be cancelled
LIMIT = 30

# Timeout for cancel requests in seconds
TIMEOUT = 5

arslanm

cat <<EOF | kubectl create -f -
apiVersion: v1
kind: Secret
metadata:
  name: filebeatssl
  namespace: kube-system
type: Opaque
data:
  cacert: $(cat cacert.crt | base64 | tr -d '\n')
  cert: $(cat client.crt | base64 | tr -d '\n')

arslanm

input {
  # ...
  # filebeat access at port 5514
  beats {
    port => 5514
    type => beats
    ssl => true
    ssl_certificate_authorities => [ "/etc/logstash/ssl/cacert.crt" ]
    ssl_certificate => "/etc/logstash/ssl/server.crt"
    ssl_key => "/etc/logstash/ssl/server.key"

arslanm

filter {
  # ...
  # logs delivered by filebeat
  if [program] == "filebeat_k8s" {
    mutate {
      rename => { "log" => "message" }
    }
    date {
      match => ["time", "ISO8601"]
      remove_field => ["time"]

arslanm

# -*- coding: utf-8 -*-
# /usr/libexec/netdata/python.d/postfix_delivered.chart.py
from base import SocketService

update_every = 5
priority = 60000
retries = 60

ORDER = ['delivered']

arslanm

#!/usr/bin/env python

import os, sys, time
import socket, threading
from pwd import getpwnam

class tail(object):
  def __init__(self, file):
    self.file = file

arslanm

apiVersion: extensions/v1beta1
kind: DaemonSet
metadata:
  name: filebeat
  namespace: kube-system
  labels:
    app: filebeat
    k8s-app: filebeat
    kubernetes.io/cluster-service: "true"
    kubernetes.io/name: "filebeat"

arslanm

all: build push

REGISTRY=your.registry.address
IMAGE=filebeat
TAG=5.5.0

build:
      	docker build -t $(IMAGE):$(TAG) -t $(REGISTRY)/$(IMAGE):$(TAG) .
        docker build -t $(IMAGE):$(TAG) -t $(REGISTRY)/$(IMAGE):latest .

arslanm

FROM centos:6

RUN curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-5.5.0-x86_64.rpm && \
    rpm -i filebeat-5.5.0-x86_64.rpm && \
    rm -f filebeat-5.5.0-x86_64.rpm && \
    mkdir -p /etc/filebeat

COPY filebeat.yml /etc/filebeat/filebeat.yml

RUN chmod 600 /etc/filebeat/filebeat.yml

arslanm

filebeat.registry_file: /var/log/filebeat.registry

logging.level: ${LOG_LEVEL:error}

# if you want cloud metadata included in your elastic
processors:
- add_cloud_metadata:

fields_under_root: true
fields: