apiVersion: v1
kind: ConfigMap
metadata:
  name: filebeat-config
  namespace: kube-system
data:
  filebeat.yml: |
    setup.ilm.enabled: false
    setup.template.enabled: false

    filebeat.autodiscover:
      providers:
        - type: kubernetes
          templates:
            # ---------- ↓ go语言的中转服务的Pod, go项目json格式日志 ↓ ----------
            - condition:
                and:
                  - equals:
                      kubernetes.namespace: sit
                  - equals:
                      kubernetes.labels.app: "lessie-go-api"
              config:
                - type: filestream
                  id: "container-${data.kubernetes.container.id}"
                  prospector.scanner.symlinks: true
                  close.on_state_change.removed: false
                  parsers:
                    - container: ~
                  paths:
                    - /var/log/containers/*-${data.kubernetes.container.id}.log

                  processors:
                    - add_kubernetes_metadata:
                        host: ${NODE_NAME}
                        include_fields:
                          - "kubernetes.node.hostname"
                          - "kubernetes.container.name"
                          - "kubernetes.pod.name"
                          - "kubernetes.pod.ip"
                          - "kubernetes.namespace"
                          - "kubernetes.labels.app"
                          - "kubernetes.labels.environment"
                          - "kubernetes.labels.project"

                    - decode_json_fields:
                        fields: ["message"]
                        target: "mylog"
                        overwrite_keys: true
                        add_error_key: true

                    - drop_fields:
                      fields:
                        - ""



    # ---- 输出到 Elasticsearch ----
    output.elasticsearch:
      hosts: ["http://10.0.0.38:9200"]
      username: "admin"
      password: "G7ZSKFM4AQwHQpwA"
      index: "k8s-%{[kubernetes.labels.environment]}-%{[kubernetes.labels.app]}-%{+yyyy.MM.dd}"
      # index: "k8s-%{[kubernetes.labels.app]}-%{+yyyy.MM.dd}"

    logging.level: debug
    logging.selectors:  ["*"]