apiVersion: v1
kind: ConfigMap
metadata:
  name: logstash-config
data:
  logstash.conf: |-
    input {
      beats {
        port => 5000
      }
    }

    filter {
      if [type] == "kube-logs" {

        mutate {
          rename => ["log", "message"]
        }

        date {
          match => ["time", "ISO8601"]
          remove_field => ["time"]
        }

        grok {
          match => { "source" => "/var/log/containers/%{DATA:pod_name}_%{DATA:namespace}_%{GREEDYDATA:container_name}-%{DATA:container_id}.log" }
          remove_field => ["source"]
        }
      }
    }

    output {
      elasticsearch {
        hosts => "elasticsearch:9200"
        index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
        document_type => "%{[@metadata][type]}"
      }
    }
