Deployment to get EVENTS from Kubernetes and put them into a logstash/beats/graylog collector

eventexporter.yml

---
apiVersion: v1
kind: ConfigMap
metadata:
  name: metricbeat-config
  namespace: kube-system
  labels:
    k8s-app: metricbeat
data:
  metricbeat.yml: |-
    metricbeat.config.modules:
      path: /etc/metricbeat/modules.d/*.yml
      reload.enabled: false
    output.logstash:
      hosts: ['${LOGSTASH_HOST:127.0.0.1}:${LOGSTASH_PORT:5044}']
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: metricbeat-modules
  namespace: kube-system
  labels:
    k8s-app: metricbeat
data:
  kubernetes.yml: |-
    - module: kubernetes
      metricsets: ["event"]
      in_cluster: true
      processors:
      - add_locale:
          format: abbreviation
      - drop_fields:
          fields:
           - kubernetes.event.metadata.resource_version
           - kubernetes.event.metadata.self_link
           - kubernetes.event.metadata.uid
           - kubernetes.event.metadata.name
           - kubernetes.event.involved_object.resource_version
           - kubernetes.event.involved_object.uid
           - metricset.module
           - metricset.name
           - name
---
# Deploy singleton instance in the whole cluster for some unique data sources, like kube-state-metrics
apiVersion: apps/v1beta1
kind: Deployment
metadata:
  name: eventexporter 
  namespace: kube-system
  labels:
    k8s-app: metricbeat
spec:
  template:
    metadata:
      labels:
        k8s-app: metricbeat
    spec:
      serviceAccountName: metricbeat
      containers:
      - name: metricbeat
        image: docker.elastic.co/beats/metricbeat:6.4.2
        args: [
          "-c", "/etc/metricbeat.yml",
          "-e",
        ]
        env:
        - name: LOGSTASH_HOST
          value: "127.0.0.1"
        - name: LOGSTASH_PORT
          value: "5044"
        securityContext:
          runAsUser: 0 
        resources:
          limits:
            memory: 1000Mi
        volumeMounts:
        - name: config
          mountPath: /etc/metricbeat.yml
          readOnly: true
          subPath: metricbeat.yml
        - name: modules
          mountPath: /etc/metricbeat/modules.d
          readOnly: true
      volumes:
      - name: config
        configMap:
          defaultMode: 0600
          name: metricbeat-config
      - name: modules
        configMap:
          defaultMode: 0600
          name: metricbeat-modules
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
  name: metricbeat
subjects:
- kind: ServiceAccount
  name: metricbeat
  namespace: kube-system
roleRef:
  kind: ClusterRole
  name: metricbeat
  apiGroup: rbac.authorization.k8s.io
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
  name: metricbeat
  labels:
    k8s-app: metricbeat
rules:
- apiGroups: [""]
  resources:
  - nodes
  - namespaces
  - events
  - pods
  verbs: ["get", "list", "watch"]
- apiGroups: ["extensions"]
  resources:
  - replicasets
  verbs: ["get", "list", "watch"]
- apiGroups: ["apps"]
  resources:
  - statefulsets
  - deployments
  verbs: ["get", "list", "watch"]
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: metricbeat
  namespace: kube-system
  labels:
    k8s-app: metricbeat