elastic.yaml

---
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: es
spec:
  serviceName: elasticsearch
  replicas: 8
  selector:
    matchLabels:
      x: elasticsearch
  template:
    metadata:
      labels:
        x: elasticsearch
    spec:
      initContainers:
      - name: chmod
        image: busybox
        args:
        - chown
        - 1000:1000
        - /data
        volumeMounts:
        - name: data
          mountPath: /data
      containers:
      - name: java
        image: elastic/elasticsearch:7.15.2
        env:
        - name: cluster.name
          value: this-cluster
        #- name: node.name
          #valueFrom:
            #fieldRef:
              #fieldPath: metadata.name
        - name: cluster.initial_master_nodes
          value: es-0,es-1,es-2
        - name: discovery.seed_hosts
          value: elasticsearch
        - name: ES_JAVA_OPTS
          value: "-Xms256m -Xmx256m"
        volumeMounts:
        - name: data
          mountPath: /usr/share/elasticsearch/data
  volumeClaimTemplates:
  - metadata:
      name: data
    spec:
      storageClassName: local-path
      accessModes:
      - ReadWriteOnce
      resources:
        requests:
          storage: 10Gi
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: kibana
spec:
  replicas: 2
  selector:
    matchLabels:
      x: kibana
  template:
    metadata:
      labels:
        x: kibana
    spec:
      containers:
      - name: java
        image: elastic/kibana:7.15.2
        env:
        - name: SERVER_PUBLICBASEURL
          value: https://kbn.i8c.cc
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: filebeat
spec:
  replicas: 4
  selector:
    matchLabels:
      x: filebeat
  template:
    metadata:
      labels:
        x: filebeat
    spec:
      volumes:
      - name: config
        configMap:
          name: elastic
      - name: host-time
        hostPath:
          path: /etc/localtime
      containers:
      - name: go
        image: elastic/filebeat:7.15.2
        volumeMounts:
        - mountPath: /usr/share/filebeat/filebeat.yml
          name: config
          subPath: filebeat
        - mountPath: /etc/localtime
          name: host-time
          readOnly: true

---
apiVersion: v1
kind: Service
metadata:
  name: elasticsearch
spec:
  clusterIP: None
  selector:
    x: elasticsearch

---
apiVersion: v1
kind: Service
metadata:
  name: kibana
spec:
  clusterIP: None
  selector:
    x: kibana
  ports:
  - port: 5601

---
apiVersion: v1
kind: Service
metadata:
  name: filebeat
spec:
  clusterIP: None
  selector:
    x: filebeat

---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: kibana
  annotations:
    traefik.ingress.kubernetes.io/router.entrypoints: websecure
spec:
  rules:
  - host: kibana.i8c.cc
    http: &http
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: kibana
            port:
              number: 5601
  - host: kbn.i8c.cc
    http: *http

---
apiVersion: v1
kind: ConfigMap
metadata:
  name: elastic
data:
  filebeat: |
    filebeat.inputs:
    - type: tcp
      host: :1111
      timeout: 86400

    processors:
    - drop_fields:
        fields:
        - input
        - agent
        - host
        - ecs
        - log

    - decode_json_fields:
        target: ""
        fields:
        - message

    - timestamp:
        field: ts
        ignore_missing: true
        ignore_failure: true
        layouts:
        - UNIX
        - 2006-01-02T15:04:05Z
        - 2006-01-02 15:04:05

    - drop_fields:
        fields:
        - message
        - ts

    output.elasticsearch:
      hosts: elasticsearch
      indices:
      - index: "%{[_]}-%{+yyyy.MM.dd}"
        when.has_fields:
        - _
      - index: "x-%{+yyyy.MM.dd}"

    setup.ilm.enabled: false
    setup.template:
      name: whatever
      pattern: "*"
      fields: /dev/null
      append_fields:
      - name: "@timestamp"
        type: date
      settings.index:
        number_of_replicas: 1
        translog:
          durability: async
          sync_interval: 3s