apiVersion: v1
kind: ConfigMap
metadata:
  name: filebeat-config
  namespace: kube-system
data:
  filebeat.yml: |
    setup.ilm.enabled: false
    setup.template.enabled: false

    filebeat.autodiscover:
      providers:
        # 配置 Provider
        - type: kubernetes
          node: ${NODE_NAME}
          hints.enabled: false
      
          templates:
            # ---------- go语言的中转服务的Pod, go项目json格式日志 ----------
            - condition:
                equals:
                  kubernetes.namespace: kube-system
              config:
                - type: filestream
                  id: "k8s-go-json-log-${data.kubernetes.container.id}"
                  prospector.scanner.symlinks: true
                  parsers:
                    - container: ~
                  paths:
                    - /var/log/containers/*-${data.kubernetes.container.id}.log
                  fields:
                    application: ${data.kubernetes.labels.app}
                    log_type: "goho.log"
                    environment: ${data.kubernetes.labels.environment}
                    instance: ${data.kubernetes.host}


    # ---- 输出到 Elasticsearch ----
    output.elasticsearch:
      hosts: ["http://10.0.0.38:9200"]
      username: "admin"
      password: "G7ZSKFM4AQwHQpwA"
      index: "k8s-%{[kubernetes.labels.environment]}-%{[kubernetes.labels.app]}-%{+yyyy.MM.dd}"

    logging.level: debug
    logging.selectors: ["*"]