kind: ConfigMap
apiVersion: v1
metadata:
  name: logstash-config
  namespace: kube-system
  labels:
    addonmanager.kubernetes.io/mode: Reconcile
data:
  logstash.conf: |-
    input {
        http {
            port => 5959
            type => "audit"
        }
        udp {
            port => 5959
            codec => json
        }
    }
    filter{
        if [type] == "audit"{
            split{
                field=>[items]
                remove_field=>[headers, metadata, apiVersion, kind, "@version", host]
            }
            mutate{
                rename => {items=>event}
            }
        }
    }
    output {
        elasticsearch {
            hosts => ["elasticsearch-logging:9200"]
            index => "logstash-%{[type]}-%{+YYYY.MM.dd}"
        }
        stdout { codec => rubydebug }
    }

