apiVersion: v1
kind: ConfigMap
metadata:
  name: filebeat-config
  namespace: elasticsearch
  labels:
    k8s-app: filebeat
data:
  filebeat.yml: |-

    filebeat.inputs:
    - type: container
      enabled: true
      paths:
        - /var/log/containers/*.log

      # To be used by Logstash for distinguishing index names while writing to elasticsearch.
      fields_under_root: true
      fields:
        index_prefix: k8s-logs

      # Enrich events with k8s, cloud metadata 
      processors:
        - add_cloud_metadata:
        - add_host_metadata:
        - add_kubernetes_metadata:
            host: ${NODE_NAME}
            matchers:
            - logs_path:
                logs_path: "/var/log/containers/"
    # Send events to Logstash.
    output.logstash:
      enabled: true
      hosts: ["logstash:9600"]

    # You can set logging.level to debug to see the generated events by the running filebeat instance.
    logging.level: info
    logging.to_files: false
    logging.files:
      path: /var/log/filebeat
      name: filebeat
      keepfiles: 7
      permissions: 0644