apiVersion: v1
kind: ConfigMap
metadata:
  name: filebeat
  namespace: monitoring
  labels:
    app: elasticsearch
    component: filebeat
data:
  filebeat.yml: |
    filebeat.prospectors:
    - input_type: log
      paths:
      - /hostfs/var/log/*.log
      - /hostfs/var/log/*/*.log
      tags:
      - host

    - input_type: log
      paths:
      - /hostfs/var/lib/docker/containers/*/*-json.log
      tags:
      - docker
      json.keys_under_root: false
      json.message_key: log
      json.add_error_key: true

    # avoid feedback loop
    processors:
      - drop_event:
          when:
            equals:
              some.key.in.structure.that.has.value: filebeat

    output.elasticsearch:
      hosts: ["elasticsearch.monitoring.svc:9200"]

      template.name: "filebeat"
      template.path: "filebeat.template.json"
      template.overwrite: true

    # Sets log level. The default log level is error.
    # Available log levels are: critical, error, warning, info, debug
    logging.level: info
