apiVersion: v1
kind: ConfigMap
metadata:
  name: logging-configmap
  namespace: logging
data:
  logstash.yml: |
    http.host: "0.0.0.0"
    path.config: /usr/share/logstash/pipeline

    ## Disable X-Pack
    ## see https://www.elastic.co/guide/en/x-pack/current/xpack-settings.html
    xpack.monitoring.enabled: false
  logstash.conf: |
    # all input will come from filebeat, no local logs
    input {
      beats {
        port => 5044
      }
    }

    ## some more advanced filtering and tagging of incoming kubernetes logs is done in logstash
    filter {
      if [type] == "kube-logs" {
        mutate {
          rename => ["log", "message"]
          add_tag => [ "pelias", "kubernetes" ]
        }

        date {
          match => ["time", "ISO8601"]
          remove_field => ["time"]
        }

        # all standard container logs files match a common pattern
        grok {
            match => { "source" => "/var/log/containers/%{DATA:pod_name}_%{DATA:namespace}_%{GREEDYDATA:container_name}-%{DATA:container_id}.log" }
            remove_field => ["source"]
        }

        # system services have a simpler log filename format that does not include namespace, pod names, or container ids
        grok {
            match => { "source" => "/var/log/hostlogs/%{DATA:container_name}.log" }
            add_field => { "namespace" => "kube-system" }
            remove_field => ["source"]
        }
      }
    }

    output {
        elasticsearch {
            hosts => [ "logstash-elasticsearch-service:9200" ]
        }
    }
  filebeat.yml: |
    filebeat.registry_file: /var/tmp/filebeat/filebeat_registry # store the registry on the host filesystem so it doesn't get lost when pods are stopped
    filebeat.prospectors:
    # process all docker container logs, which are stored as json
    - input_type: log
      symlinks: true
      json.message_key: log
      json.keys_under_root: true
      json.add_error_key: true
      multiline.pattern: '^\s'
      multiline.match: after
      fields:
          host: ${FILEBEAT_HOST:${HOSTNAME}}
          type: kube-logs
      fields_under_root: true
      paths:
        - /var/log/containers/*.log
    # process system logs, such as kube-apiserver, kube-controller-manager, etc
    - input_type: log
      fields:
          host: ${FILEBEAT_HOST:${HOSTNAME}}
          type: kube-logs
      fields_under_root: true
      paths:
        - /var/log/hostlogs/kube*.log
    output.logstash:
      hosts: ["logstash-service:5044"]
  kibana.yml: |
    ## Default Kibana configuration from kibana-docker.
    ## from https://github.com/elastic/kibana-docker/blob/master/build/kibana/config/kibana.yml
    #
    #server.host: "0"
    elasticsearch.url: http://logstash-elasticsearch-service:9200

    ## Disable X-Pack
    ## see https://www.elastic.co/guide/en/x-pack/current/xpack-settings.html
    ##     https://www.elastic.co/guide/en/x-pack/current/installing-xpack.html#xpack-enabling
    #
    xpack.security.enabled: false
    xpack.monitoring.enabled: false
    xpack.ml.enabled: false
    xpack.graph.enabled: false
    xpack.reporting.enabled: false
