apiVersion: v1
kind: ConfigMap
metadata:
  name: filebeat-config
  namespace: kube-system
data:
  filebeat.yml: |
    setup.ilm.enabled: false
    setup.template.enabled: false

    filebeat.autodiscover:
      providers:
        - type: kubernetes
          node: ${NODE_NAME}
          hints.enabled: true
          hints.default_config:
            type: filestream
            id: container-${data.kubernetes.container.id}
            prospector.scanner.symlinks: true
            parsers:
              - container: ~
            paths:
              - /var/log/containers/*-${data.kubernetes.container.id}.log

          # templates:
          #   - condition:
          #       exists: ['kubernetes.pod.name'] 
          #     config:
          #       - type: container
          #         id: "debug"
          #         paths:
          #           - /var/log/containers/*.log
          #         # follow_symlinks: true
          #         # parsers:
          #         #   - container: ~


    # ---- 输出到 Elasticsearch ----
    output.elasticsearch:
      hosts: ["http://10.0.0.38:9200"]
      username: "admin"
      password: "G7ZSKFM4AQwHQpwA"

      # 动态索引命名：k8s-环境-应用-日期
      index: "k8s-%{[kubernetes.labels.environment]}-%{[kubernetes.labels.app]}-%{+yyyy.MM.dd}"

    logging.level: debug
    logging.selectors: ["*"]