Created
July 26, 2021 09:04
-
-
Save omersiar/85aa921c84380caed3db6c257fda1d87 to your computer and use it in GitHub Desktop.
Filebeat
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
--- | |
apiVersion: rbac.authorization.k8s.io/v1 | |
kind: ClusterRole | |
metadata: | |
name: filebeat | |
labels: | |
k8s-app: filebeat | |
rules: | |
- apiGroups: [""] # "" indicates the core API group | |
resources: | |
- namespaces | |
- pods | |
verbs: | |
- get | |
- watch | |
- list |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
--- | |
apiVersion: v1 | |
kind: ConfigMap | |
metadata: | |
name: filebeat-config | |
namespace: kube-system | |
labels: | |
k8s-app: filebeat | |
data: | |
filebeat.yml: |- | |
logging.level: info | |
setup.template.name: "ocp" | |
setup.template.pattern: "ocp-*" | |
filebeat.autodiscover: | |
providers: | |
- type: kubernetes | |
node: ${NODE_NAME} | |
templates: | |
- condition: | |
equals: | |
kubernetes.namespace: demo2 | |
config: | |
- type: container | |
paths: | |
- /var/log/containers/*${data.kubernetes.container.id}.log | |
- condition: | |
equals: | |
kubernetes.namespace: demo3 | |
config: | |
- type: container | |
paths: | |
- /var/log/containers/*${data.kubernetes.container.id}.log | |
processors: | |
- add_host_metadata: | |
output.elasticsearch: | |
hosts: ['https://192.168.1.141:9200'] | |
username: elastic | |
password: mxcvqK2gCoyjoH74NZlj | |
ssl.verification_mode: none | |
index: "%{[kubernetes.namespace]:filebeat}-%{[beat.version]}-%{+yyyy.MM.dd}" |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
--- | |
apiVersion: apps/v1 | |
kind: DaemonSet | |
metadata: | |
name: filebeat | |
namespace: kube-system | |
labels: | |
k8s-app: filebeat | |
spec: | |
selector: | |
matchLabels: | |
k8s-app: filebeat | |
template: | |
metadata: | |
labels: | |
k8s-app: filebeat | |
spec: | |
serviceAccountName: filebeat | |
terminationGracePeriodSeconds: 30 | |
hostNetwork: true | |
dnsPolicy: ClusterFirstWithHostNet | |
containers: | |
- name: filebeat | |
image: docker.elastic.co/beats/filebeat:7.9.2 | |
args: [ | |
"-c", "/etc/filebeat.yml", | |
"-e", | |
] | |
env: | |
- name: NODE_NAME | |
valueFrom: | |
fieldRef: | |
fieldPath: spec.nodeName | |
securityContext: | |
runAsUser: 0 | |
# If using Red Hat OpenShift uncomment this: | |
privileged: true | |
resources: | |
limits: | |
memory: 200Mi | |
requests: | |
cpu: 100m | |
memory: 100Mi | |
volumeMounts: | |
- name: config | |
mountPath: /etc/filebeat.yml | |
readOnly: true | |
subPath: filebeat.yml | |
- name: data | |
mountPath: /usr/share/filebeat/data | |
- name: varlibdockercontainers | |
mountPath: /var/lib/docker/containers | |
readOnly: true | |
- name: varlog | |
mountPath: /var/log | |
readOnly: true | |
volumes: | |
- name: config | |
configMap: | |
defaultMode: 0640 | |
name: filebeat-config | |
- name: varlibdockercontainers | |
hostPath: | |
path: /var/lib/docker/containers | |
- name: varlog | |
hostPath: | |
path: /var/log | |
# data folder stores a registry of read status for all files, so we don't send everything again on a Filebeat pod restart | |
- name: data | |
hostPath: | |
# When filebeat runs as non-root user, this directory needs to be writable by group (g+w). | |
path: /var/lib/filebeat-data | |
type: DirectoryOrCreate |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
--- | |
apiVersion: rbac.authorization.k8s.io/v1 | |
kind: ClusterRoleBinding | |
metadata: | |
name: filebeat | |
subjects: | |
- kind: ServiceAccount | |
name: filebeat | |
namespace: kube-system | |
roleRef: | |
kind: ClusterRole | |
name: filebeat | |
apiGroup: rbac.authorization.k8s.io |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
--- | |
apiVersion: v1 | |
kind: ServiceAccount | |
metadata: | |
name: filebeat | |
namespace: kube-system | |
labels: | |
k8s-app: filebeat |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment