apiVersion: v1
kind: ConfigMap
metadata:
  name: logstash-config
  namespace: infra
  labels:
    name: logstash-config
    namespace: infra
data:
  elasticsearch-pipeline.conf: |
    input {
      beats {
        port => 5044
      }
    }

    filter {
      if [type] == "kube-logs" {

        if [log] =~ /^[{].*[}]$/ {
          json {
            source => "log"
            skip_on_invalid_json => true
          }
        } else {
          mutate {
            rename => ["log", "message"]
          }
        }

        date {
          match => ["time", "ISO8601"]
          remove_field => ["time"]
        }

        grok {
            match => { "source" => "/var/log/containers/%{DATA:pod_name}_%{DATA:namespace}_%{GREEDYDATA:container_name}-%{DATA:container_id}.log" }
            remove_field => ["source"]
        }
      }
    }

    output {
      elasticsearch {
        hosts => ["http://elasticsearch.infra:9200"]
        index => "%{[@metadata][container_name]}-%{+YYYY.MM.dd}"
        document_type => "%{[@metadata][type]}"
      }
    }
