Download
Link
collectorforkubernetes-elasticsearch.yaml
CURL
1curl -O https://www.outcoldsolutions.com/docs/elasticsearch-kubernetes/collectorforkubernetes-elasticsearch.yamlWGET
1wget https://www.outcoldsolutions.com/docs/elasticsearch-kubernetes/collectorforkubernetes-elasticsearch.yamlcollectorforkubernetes.yaml
1apiVersion: v1
2kind: Namespace
3metadata:
4 labels:
5 app: collectorforkubernetes
6 name: collectorforkubernetes
7---
8apiVersion: apiextensions.k8s.io/v1
9kind: CustomResourceDefinition
10metadata:
11 name: configurations.collectord.io
12spec:
13 group: collectord.io
14 versions:
15 - name: v1
16 served: true
17 storage: true
18 schema:
19 openAPIV3Schema:
20 type: object
21 properties:
22 spec:
23 type: object
24 additionalProperties: true
25 force:
26 type: boolean
27 scope: Cluster
28 names:
29 plural: configurations
30 singular: configuration
31 kind: Configuration
32---
33apiVersion: v1
34kind: ServiceAccount
35metadata:
36 labels:
37 app: collectorforkubernetes
38 name: collectorforkubernetes
39 namespace: collectorforkubernetes
40---
41apiVersion: scheduling.k8s.io/v1
42kind: PriorityClass
43metadata:
44 name: collectorforkubernetes-critical
45value: 1000000000
46---
47apiVersion: rbac.authorization.k8s.io/v1
48kind: ClusterRole
49metadata:
50 labels:
51 app: collectorforkubernetes
52 name: collectorforkubernetes
53rules:
54- apiGroups: ['extensions']
55 resources: ['podsecuritypolicies']
56 verbs: ['use']
57 resourceNames:
58 - privileged
59- apiGroups:
60 - ""
61 - apps
62 - batch
63 - extensions
64 - rbac.authorization.k8s.io
65 - collectord.io
66 resources:
67 - alertmanagers
68 - cronjobs
69 - daemonsets
70 - deployments
71 - endpoints
72 - events
73 - jobs
74 - namespaces
75 - nodes
76 - nodes/metrics
77 - nodes/proxy
78 - pods
79 - replicasets
80 - replicationcontrollers
81 - scheduledjobs
82 - services
83 - statefulsets
84 - persistentvolumeclaims
85 - configurations
86 - resourcequotas
87 - clusterroles
88 - secrets
89 - configmaps
90 verbs:
91 - get
92 - list
93 - watch
94- nonResourceURLs:
95 - /metrics
96 verbs:
97 - get
98 apiGroups: []
99 resources: []
100---
101apiVersion: rbac.authorization.k8s.io/v1
102kind: ClusterRoleBinding
103metadata:
104 labels:
105 app: collectorforkubernetes
106 name: collectorforkubernetes
107 namespace: collectorforkubernetes
108roleRef:
109 apiGroup: rbac.authorization.k8s.io
110 kind: ClusterRole
111 name: collectorforkubernetes
112subjects:
113 - kind: ServiceAccount
114 name: collectorforkubernetes
115 namespace: collectorforkubernetes
116---
117apiVersion: v1
118kind: ConfigMap
119metadata:
120 name: collectorforkubernetes-elasticsearch
121 namespace: collectorforkubernetes
122 labels:
123 app: collectorforkubernetes-elasticsearch
124data:
125 001-general.conf: |
126 # The general configuration is used for all deployments
127 #
128 # Run collectord with the flag -conf and specify location of the configuration files.
129 #
130 # You can override all the values using environment variables with the format like
131 # COLLECTOR__<ANYNAME>=<section>__<key>=<value>
132 # As an example you can set dataPath in [general] section as
133 # COLLECTOR__DATAPATH=general__dataPath=C:\\some\\path\\data.db
134 # This parameter can be configured using -env-override, set it to empty string to disable this feature
135
136 [general]
137 # Please review license https://www.outcoldsolutions.com/legal/license-agreement/
138 # and accept license by changing the value to *true*
139 acceptLicense = false
140
141 # Location for the database
142 # Collectord stores positions of the files and internal state
143 dataPath = ./data/
144
145 # log level (accepted values are trace, debug, info, warn, error, fatal)
146 logLevel = info
147
148 # http server gives access to two endpoints
149 # /healthz
150 # /metrics/json
151 # /metrics/prometheus
152 httpServerBinding =
153
154 # telemetry report endpoint, set it to empty string to disable telemetry
155 telemetryEndpoint = https://license.outcold.solutions/telemetry/
156
157 # license check endpoint
158 licenseEndpoint = https://license.outcold.solutions/license/
159
160 # license server through proxy
161 licenseServerProxyUrl =
162
163 # authentication with basic authorization (user:password)
164 licenseServerProxyBasicAuth =
165
166 # license key
167 license =
168
169 # Environment variable $KUBERNETES_NODENAME is used by default to setup hostname
170 # Use value below to override specific name
171 # hostname = ${KUBERNETES_NODENAME}.second
172
173 # Default output for events, logs and metrics
174 # valid values: elasticsearch and devnull
175 # Use devnull by default if you don't want to redirect data
176 defaultOutput = elasticsearch
177
178 # Buffer size for file reads. 8k matches the common filesystem block size and
179 # cuts the number of read syscalls substantially versus the historical 256b.
180 fileInputBufferSize = 8k
181
182 # Maximum size of one line the file reader can read
183 fileInputLineMaxSize = 1mb
184
185 # Include custom fields to attach to every event, in example below every event sent to elasticsearch will have
186 # indexed field my_environment=dev. Fields names should match to ^[a-z][_a-z0-9\.]*$
187 # Better way to configure that is to specify labels for Kubernetes Nodes.
188 # ; fields.my_environment = dev
189 # Identify the cluster if you are planning to monitor multiple clusters
190 # For ElasticSearch look at the ECS (Elastic Common Schema) documentation https://www.elastic.co/guide/en/ecs/current/ecs-field-reference.html
191 fields.ecs.version = 8.0.0
192
193 fields.orchestrator.cluster.name = -
194 fields.orchestrator.type = kubernetes
195
196 fields.agent.type = collectord
197 fields.agent.version = ${COLLECTORD_VERSION}
198 fields.agent.ephemeral_id = ${COLLECTORD_INSTANCE_RUNTIME_ID}
199 fields.agent.id = ${COLLECTORD_INSTANCE_ID}
200 fields.agent.name = ${KUBERNETES_NODENAME}
201
202 fields.host.name = ${KUBERNETES_NODENAME}
203 fields.host.hostname = ${KUBERNETES_NODENAME}
204 fields.host.architecture = ${COLLECTORD_ARCH}
205
206 # Include EC2 Metadata (see list of possible fields https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html)
207 # Should be in format ec2Metadata.{desired_field_name} = {url path to read the value}
208 # ec2Metadata.cloud.instance.id = /latest/meta-data/instance-id
209 # ec2Metadata.cloud.machine.type = /latest/meta-data/instance-type
210
211 # subdomain for the annotations added to the pods, workloads, namespaces or containers, like elasticsearch.collectord.io/..
212 annotationsSubdomain = elasticsearch
213
214 # configure global thruput per second for forwarded logs (metrics are not included)
215 # for example if you set `thruputPerSecond = 512Kb`, that will limit amount of logs forwarded
216 # from the single Collectord instance to 512Kb per second.
217 # You can configure thruput individually for the logs (including specific for container logs) below
218 thruputPerSecond =
219 ; thruputPerSecond = 512Kb
220
221 # Configure events that are too old to be forwarded, for example 168h (7 days) - that will drop all events
222 # older than 7 days
223 tooOldEvents =
224
225 # Configure events that are too new to be forwarded, for example 1h - that will drop all events that are 1h in future
226 tooNewEvents =
227
228 # Multi-output async publishing. When enabled (default), events routed to
229 # non-default outputs are published asynchronously so that a slow or down
230 # output does not block events destined for other outputs.
231 ; multioutput.async = true
232 # Buffer size for the async proxy (default 100). Absorbs transient bursts.
233 # When this buffer and the output's own queue are both full, events are
234 # dropped immediately without blocking the pipeline.
235 ; multioutput.asyncBufferSize = 100
236
237 [license.client]
238 # point to the license located on the HTTP web server, or a hosted by the Collectord running as license server
239 url =
240 # basic authentication for the HTTP server
241 basicAuth =
242 # if SSL, ignore the certificate verification
243 insecure = false
244 # CA Path for the Server certificate
245 capath =
246 # CA Name fot the Server certificate
247 caname =
248 # license server through proxy
249 proxyUrl =
250 # authentication with basic authorization (user:password)
251 proxyBasicAuth =
252
253 # connection to kubernetes api
254 [general.kubernetes]
255
256 # Override service URL for Kubernetes (default is ${KUBERNETES_SERVICE_HOST}:${KUBERNETES_SERVICE_PORT})
257 serviceURL =
258
259 # Environment variable $KUBERNETES_NODENAME is used by default to setup nodeName
260 # Use it only when you need to override it
261 nodeName =
262
263 # Configuration to access the API server,
264 # see https://kubernetes.io/docs/tasks/access-application-cluster/access-cluster/#accessing-the-api-from-a-pod
265 # for details
266 tokenPath = /var/run/secrets/kubernetes.io/serviceaccount/token
267 certPath = /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
268
269 # Default timeout for http responses. The streaming/watch requests depend on this timeout.
270 timeout = 30m
271
272 # How long to keep the cache for the recent calls to API server (to limit number of calls when collectord discovers new pods)
273 metadataTTL = 30s
274
275 # path to the kubelet root location (use it to discover application logs for emptyDir)
276 # the expected format is `pods/{pod-id}/volumes/kubernetes.io~empty-dir/{volume-name}/_data/`
277 volumesRootDir = /rootfs/var/lib/kubelet/
278
279 # You can attach annotations as a metadata, using the format
280 # includeAnnotations.{key} = {regexp}
281 # For example if you want to include all annotations that starts with `prometheus.io` or `example.com` you can include
282 # the following format:
283 # includeAnnotations.1 = ^prometheus\.io.*
284 # includeAnnotations.2 = ^example\.com.*
285
286 # watch for changes (annotations) in the objects
287 watch.namespaces = v1/namespace
288 watch.deployments = apps/v1/deployment
289 watch.configurations = collectord.io/v1/configuration
290
291 # Collectord can review the assigned ClusterRole and traverse metadata for the Pods only for the Owner objects
292 # that are defined in the ClusterRole, ignoring anything else, it does not have access to.
293 # This way Collectord does not generate 403 requests on API Server
294 clusterRole = collectorforkubernetes
295
296 # Alternative of telling Collectord about the ClusterRole is to manually list the objects.
297 # You can define which objects Collectord should traverse when it sees Owners.
298 ; traverseOwnership.namespaces = v1/namespace
299
300
301 # ElasticSearch output
302 [output.elasticsearch]
303
304 # Default data stream name
305 dataStream = logs-collectord-{{agent.version}}
306 dataStreamFailedEvents = logs-collectord-failed-{{agent.version}}
307
308 # ElasticSearch Scheme Host and Port
309 host =
310
311 # You can specify multiple hosts with
312 #
313 # hosts.0 = https://es0:9200
314 # hosts.1 = https://es1:9200
315 # hosts.2 = https://es2:9200
316
317 # Specify how Hosts should be picked up (in case if multiple is used)
318 # * random - choose random url on first selection and after each failure (connection or HTTP status code >= 500)
319 # * round-robin - choose url starting from first one and bump on each failure (connection or HTTP status code >= 500)
320 # * random-with-round-robin - choose random url on first selection and after that in round-robin on each
321 # failure (connection or HTTP status code >= 500)
322 hostSelection = random-with-round-robin
323
324 # Configuration for basic authorization
325 authorizationBasicUsername =
326 authorizationBasicPassword =
327
328 # additional headers
329 headers.Content-Type = application/json
330 headers.Accept = application/json
331
332 # Allow invalid SSL server certificate
333 insecure = false
334
335 # Path to CA certificate
336 caPath =
337
338 # CA Name to verify
339 caName =
340
341 # path for client certificate (if required)
342 clientCertPath =
343
344 # path for a client key (if required)
345 clientKeyPath =
346
347 # Events are batched with the maximum size set by batchSize and staying in pipeline for not longer
348 # than set by frequency
349 frequency = 5s
350 batchSize = 768K
351 # limit by the number of events (0 value has no limit on the number of events)
352 events = 50
353
354 # elasticsearch through proxy
355 proxyUrl =
356
357 # authentication with basic authorization (user:password)
358 proxyBasicAuth =
359
360 # Timeout specifies a time limit for requests made by collectord.
361 # The timeout includes connection time, any
362 # redirects, and reading the response body.
363 timeout = 30s
364
365 # gzip compression level (nocompression, default, 1...9)
366 compressionLevel = default
367
368 # number of dedicated elasticsearch output threads (to increase throughput above 4k events per second)
369 threads = 2
370 # Default algorithm between threads is roundrobin, but you can change it to weighted
371 threadsAlgorithm = roundrobin
372
373 # Submit objects to elasticsearch
374 put._ilm/policy/logs-collectord = /config/es-default-index-lifecycle-management-policy.json
375 put._index_template/logs-collectord-${COLLECTORD_VERSION} = /config/es-default-index-template.json
376 put._index_template/logs-collectord-failed-${COLLECTORD_VERSION} = /config/es-failed-index-template.json
377
378 # Dedicated queue size for the output, default is 1024, larger queue sizes will require more memory,
379 # but will allow to handle more events in case of network issues
380 queueSize = 1024
381
382 # Configure multiple outputs
383 # [output.elasticsearch::app1]
384 # host = http://esapp1:9200
385
386 002-daemonset.conf: |
387 # DaemonSet configuration is used for Nodes and Masters.
388
389 // connection to CRIO
390 [general.cri-o]
391
392 # url for CRIO API, only unix socket is supported
393 url = unix:///rootfs/var/run/crio/crio.sock
394
395 # Timeout for http responses to docker client. The streaming requests depend on this timeout.
396 timeout = 1m
397
398 [general.containerd]
399
400 runtimePath = /rootfs/var/run/containerd
401 namespace = k8s.io
402
403 # Container Log files
404 [input.files]
405
406 # disable container logs monitoring
407 disabled = false
408
409 # root location of docker log files
410 # logs are expected in standard docker format like {containerID}/{containerID}-json.log
411 # rotated files
412 path = /rootfs/var/lib/docker/containers/
413 # root location of CRI-O (including Containerd) files
414 # logs are expected in Kubernetes format, like {podID}/{containerName}/0.log
415 crioPath = /rootfs/var/log/pods/
416
417 # files are read using polling schema, when reach the EOF how often to check if files got updated
418 pollingInterval = 250ms
419
420 # how often to look for the new files under logs path
421 walkingInterval = 5s
422
423 # override type
424 type = container
425
426 # override datastream
427 elasticsearch.datastream =
428
429 # docker splits events when they are larger than 10-100k (depends on the docker version)
430 # we join them together by default and forward to elasticsearch as one event
431 joinPartialEvents = true
432
433 # In case if your containers report messages with terminal colors or other escape sequences
434 # you can enable strip for all the containers in one place.
435 # Better is to enable it only for required container with the label collectord.io/strip-terminal-escape-sequences=true
436 stripTerminalEscapeSequences = false
437 # Regexp used for stripping terminal colors, it does not stip all the escape sequences
438 # Read https://man7.org/linux/man-pages/man4/console_codes.4.html for more information
439 stripTerminalEscapeSequencesRegex = (\x1b\[\d{1,3}(;\d{1,3})*m)|(\x07)|(\x1b]\d+(\s\d)?;[^\x07]+\x07)|(.*\x1b\[K)
440
441 # sample output (-1 does not sample, 20 - only 20% of the logs should be forwarded)
442 samplingPercent = -1
443
444 # sampling key for hash based sampling (should be regexp with the named match pattern `key`)
445 samplingKey =
446
447 # set output (elasticsearch or devnull, default is [general]defaultOutput)
448 output =
449
450 # configure default thruput per second for each container log
451 # for example if you set `thruputPerSecond = 128Kb`, that will limit amount of logs forwarded
452 # from the single container to 128Kb per second.
453 thruputPerSecond =
454
455 # Configure events that are too old to be forwarded, for example 168h (7 days) - that will drop all events
456 # older than 7 days
457 tooOldEvents =
458
459 # Configure events that are too new to be forwarded, for example 1h - that will drop all events that are 1h in future
460 tooNewEvents =
461
462
463 # Application Logs
464 [input.app_logs]
465
466 # disable container application logs monitoring
467 disabled = false
468
469 # root location of mounts (applies to hostPath mounts only), if the hostPath differs inside container from the path on host
470 root = /rootfs/
471
472 # how often to review list of available volumes
473 syncInterval = 5s
474
475 # glob matching pattern for log files
476 glob = *.log*
477
478 # files are read using polling schema, when reach the EOF how often to check if files got updated
479 pollingInterval = 250ms
480
481 # how often to look for the new files under logs path
482 walkingInterval = 5s
483
484 # include verbose fields in events (file offset)
485 verboseFields = false
486
487 # override type
488 type = container.file
489
490 # override datastream
491 elasticsearch.datastream =
492
493 # we split files using new line character, with this configuration you can specify what defines the new event
494 # after new line
495 eventPatternRegex = ^[^\s]
496 # Maximum interval of messages in pipeline
497 eventPatternMaxInterval = 100ms
498 # Maximum time to wait for the messages in pipeline
499 eventPatternMaxWait = 1s
500 # Maximum message size
501 eventPatternMaxSize = 1MB
502
503 # sample output (-1 does not sample, 20 - only 20% of the logs should be forwarded)
504 samplingPercent = -1
505
506 # sampling key for hash based sampling (should be regexp with the named match pattern `key`)
507 samplingKey =
508
509 # set output (elasticsearch or devnull, default is [general]defaultOutput)
510 output =
511
512 # configure default thruput per second for for each container log
513 # for example if you set `thruputPerSecond = 128Kb`, that will limit amount of logs forwarded
514 # from the single container to 128Kb per second.
515 thruputPerSecond =
516
517 # Configure events that are too old to be forwarded, for example 168h (7 days) - that will drop all events
518 # older than 7 days
519 tooOldEvents =
520
521 # Configure events that are too new to be forwarded, for example 1h - that will drop all events that are 1h in future
522 tooNewEvents =
523
524 # Configure how long Collectord should keep the file descriptors open for files, that has not been forwarded yet
525 # When using PVC, and if pipeline is lagging behind, Collectord holding open fd for files, can cause long termination
526 # of pods, as kubelet cannot unmount the PVC volume from the system
527 maxHoldAfterClose = 1800s
528
529
530 # Host logs. Input syslog(.\d+)? files
531 [input.files::syslog]
532
533 # disable host level logs
534 disabled = false
535
536 # root location of docker files
537 path = /rootfs/var/log/
538
539 # regex matching pattern
540 match = ^(syslog|messages)(.\d+)?$
541
542 # limit search only on one level
543 recursive = false
544
545 # files are read using polling schema, when reach the EOF how often to check if files got updated
546 pollingInterval = 250ms
547
548 # how often o look for the new files under logs path
549 walkingInterval = 5s
550
551 # include verbose fields in events (file offset)
552 verboseFields = false
553
554 # override type
555 type = file
556
557 # override datastream
558 elasticsearch.datastream =
559
560 # field extraction
561 extraction = ^(?P<timestamp>[A-Za-z]+\s+\d+\s\d+:\d+:\d+)\s(?P<log__syslog__hostname>[^\s]+)\s(?P<log__syslog__appname>[^:\[]+)(\[(?P<log__syslog__procid>\d+)\])?: (.+)$
562 # extractionMessageField =
563
564 # timestamp field
565 timestampField = timestamp
566
567 # format for timestamp
568 # the layout defines the format by showing how the reference time, defined to be `Mon Jan 2 15:04:05 -0700 MST 2006`
569 timestampFormat = Jan 2 15:04:05
570
571 # Adjust date, if month/day aren't set in format
572 timestampSetMonth = false
573 timestampSetDay = false
574
575 # timestamp location (if not defined by format)
576 timestampLocation = Local
577
578 # sample output (-1 does not sample, 20 - only 20% of the logs should be forwarded)
579 samplingPercent = -1
580
581 # sampling key for hash based sampling (should be regexp with the named match pattern `key`)
582 samplingKey =
583
584 # set output (elasticsearch or devnull, default is [general]defaultOutput)
585 output =
586
587 # configure default thruput per second for this files group
588 # for example if you set `thruputPerSecond = 128Kb`, that will limit amount of logs forwarded
589 # from the files in this group to 128Kb per second.
590 thruputPerSecond =
591
592 # Configure events that are too old to be forwarded, for example 168h (7 days) - that will drop all events
593 # older than 7 days
594 tooOldEvents =
595
596 # Configure events that are too new to be forwarded, for example 1h - that will drop all events that are 1h in future
597 tooNewEvents =
598
599 # by default every new event should start from not space symbol
600 eventPattern = ^[^\s]
601
602 # Blacklisting and whitelisting the logs
603 # whitelist.0 = ^regexp$
604 # blacklist.0 = ^regexp$
605
606
607 # Host logs. Input all *.log(.\d+)? files
608 [input.files::logs]
609
610 # disable host level logs
611 disabled = false
612
613 # root location of log files
614 path = /rootfs/var/log/
615
616 # regex matching pattern
617 match = ^(([\w\-.]+\.log(.[\d\-]+)?)|(docker))$
618
619 # files are read using polling schema, when reach the EOF how often to check if files got updated
620 pollingInterval = 250ms
621
622 # how often o look for the new files under logs path
623 walkingInterval = 5s
624
625 # include verbose fields in events (file offset)
626 verboseFields = false
627
628 # override type
629 type = file
630
631 # override datastream
632 elasticsearch.datastream =
633
634 # field extraction
635 extraction =
636
637 # timestamp field
638 timestampField =
639
640 # format for timestamp
641 # the layout defines the format by showing how the reference time, defined to be `Mon Jan 2 15:04:05 -0700 MST 2006`
642 timestampFormat =
643
644 # timestamp location (if not defined by format)
645 timestampLocation =
646
647 # sample output (-1 does not sample, 20 - only 20% of the logs should be forwarded)
648 samplingPercent = -1
649
650 # sampling key for hash based sampling (should be regexp with the named match pattern `key`)
651 samplingKey =
652
653 # set output (elasticsearch or devnull, default is [general]defaultOutput)
654 output =
655
656 # configure default thruput per second for this files group
657 # for example if you set `thruputPerSecond = 128Kb`, that will limit amount of logs forwarded
658 # from the files in this group to 128Kb per second.
659 thruputPerSecond =
660
661 # Configure events that are too old to be forwarded, for example 168h (7 days) - that will drop all events
662 # older than 7 days
663 tooOldEvents =
664
665 # Configure events that are too new to be forwarded, for example 1h - that will drop all events that are 1h in future
666 tooNewEvents =
667
668 # by default every new event should start from not space symbol
669 eventPattern = ^[^\s]
670
671 # Blacklisting and whitelisting the logs
672 # whitelist.0 = ^regexp$
673 # blacklist.0 = ^regexp$
674
675
676 [input.journald]
677
678 # disable host level logs
679 disabled = false
680
681 # root location of log files
682 path.persistent = /rootfs/var/log/journal/
683 path.volatile = /rootfs/run/log/journal/
684
685 # when reach end of journald, how often to pull
686 pollingInterval = 250ms
687
688 # if you don't want to forward journald from the beginning,
689 # set the oldest event in relative value, like -14h or -30m or -30s (h/m/s supported)
690 startFromRel =
691
692 # override type
693 type = journald
694
695 # override datastream
696 elasticsearch.datastream =
697
698 # sample output (-1 does not sample, 20 - only 20% of the logs should be forwarded)
699 samplingPercent = -1
700
701 # sampling key (should be regexp with the named match pattern `key`)
702 samplingKey =
703
704 # how often to reopen the journald to free old files
705 reopenInterval = 1h
706
707 # set output (elasticsearch or devnull, default is [general]defaultOutput)
708 output =
709
710 # configure default thruput per second for journald
711 # for example if you set `thruputPerSecond = 128Kb`, that will limit amount of logs forwarded
712 # from the journald to 128Kb per second.
713 thruputPerSecond =
714
715 # Configure events that are too old to be forwarded, for example 168h (7 days) - that will drop all events
716 # older than 7 days
717 tooOldEvents =
718
719 # Configure events that are too new to be forwarded, for example 1h - that will drop all events that are 1h in future
720 tooNewEvents =
721
722 # by default every new event should start from not space symbol
723 eventPattern = ^[^\s]
724
725 # Blacklisting and whitelisting the logs
726 # whitelist.0 = ^regexp$
727 # blacklist.0 = ^regexp$
728
729 # Pipe to join events (container logs only)
730 [pipe.join]
731
732 # disable joining event
733 disabled = false
734
735 # Maximum interval of messages in pipeline
736 maxInterval = 100ms
737
738 # Maximum time to wait for the messages in pipeline
739 maxWait = 1s
740
741 # Maximum message size
742 maxSize = 1MB
743
744 # Default pattern to indicate new message (should start not from space)
745 patternRegex = ^[^\s]
746
747 # You can configure global replace rules for the events, which can help to remove sensitive data
748 # from logs before they are sent to Splunk. Those rules will be applied to all pipelines for container logs, host logs,
749 # application logs and events.
750 # In the following example we replace password=TEST with password=********
751 ; [pipe.replace::name]
752 ; patternRegex = (password=)([^\s]+)
753 ; replace = $1********
754
755 # You can configure global hash rules for the events, which can help to hide sensitive data
756 # from logs before they are sent to outputs. Those rules will be applied to all pipelines for container logs, host logs,
757 # application logs and events.
758 # In the following example we hash IP addresses with fnv-1a-64
759 ; [pipe.hash::name]
760 ; match = (\d{1,3}\.){3}\d{1,3}'
761 ; function = fnv-1a-64
762
763 004-addon.conf: |
764 [ general ]
765
766 # addons can be run in parallel with agents
767 addon = true
768
769 [input.kubernetes_events]
770
771 # disable events
772 disabled = false
773
774 # override type
775 type = events
776
777 # override datastream
778 elasticsearch.datastream =
779
780 # set output (elasticsearch or devnull, default is [general]defaultOutput)
781 output =
782
783 # exclude managed fields from the metadata
784 excludeManagedFields = true
785
786 [input.kubernetes_watch::pods]
787
788 # disable events
789 disabled = false
790
791 # Set the timeout for how often watch request should refresh the whole list
792 refresh = 10m
793
794 apiVersion = v1
795 kind = Pod
796 namespace =
797 excludeManagedFields = true
798
799 # override type
800 type = objects
801
802 # override datastream
803 elasticsearch.datastream =
804
805 # set output (elasticsearch or devnull, default is [general]defaultOutput)
806 output =
807
808 # you can remove or hash some values in the events (after modifyValues you can define path in the JSON object,
809 # and the value can be hash:{hashFunction}, or remove to remove the object )
810 ; modifyValues.object.data.* = hash:sha256
811 ; modifyValues.object.metadata.annotations.* = remove
812
813 # You can exclude events by namespace with blacklist or whitelist only required namespaces
814 # blacklist.kubernetes_namespace = ^namespace0$
815 # whitelist.kubernetes_namespace = ^((namespace1)|(namespace2))$
816
817 [input.kubernetes_watch::deployments]
818
819 # disable events
820 disabled = false
821
822 # Set the timeout for how often watch request should refresh the whole list
823 refresh = 10m
824
825 apiVersion = apps/v1
826 kind = deployment
827 namespace =
828 excludeManagedFields = true
829
830 # override type
831 type = objects
832
833 # override datastream
834 elasticsearch.datastream =
835
836 # set output (elasticsearch or devnull, default is [general]defaultOutput)
837 output =
838
839 es-default-index-lifecycle-management-policy.json: |
840 {
841 "policy": {
842 "_meta": {
843 "description": "Default policy for Collectord indexes",
844 "version": 1
845 },
846 "phases": {
847 "hot": {
848 "min_age": "0ms",
849 "actions": {
850 "rollover": {
851 "max_primary_shard_size": "50gb",
852 "max_age": "30d"
853 }
854 }
855 }
856 }
857 }
858 }
859 es-default-index-template.json: |
860 {
861 "version": 1,
862 "data_stream": {},
863 "_meta": {
864 "description": "Default template for Collectord indexes"
865 },
866 "priority": 500,
867 "template": {
868 "settings": {
869 "index": {
870 "lifecycle": {
871 "name": "logs-collectord"
872 },
873 "refresh_interval": "5s",
874 "mapping": {
875 "total_fields": {
876 "limit": "10000"
877 }
878 },
879 "max_docvalue_fields_search": "200"
880 },
881 "query": {
882 "default_field": [
883 "message",
884 "container.name",
885 "container.image.name",
886 "host.name",
887 "orchestrator.namespace",
888 "orchestrator.cluster.name",
889 "container.name",
890 "kubernetes.pod.name",
891 "kubernetes.pod.id",
892 "kubernetes.pod.ip",
893 "kubernetes.namespace.name",
894 "kubernetes.node.name",
895 "kubernetes.cluster.name",
896 "kubernetes.replicaset.name",
897 "kubernetes.deployment.name",
898 "kubernetes.statefulset.name",
899 "kubernetes.daemonset.name",
900 "kubernetes.job.name",
901 "kubernetes.cronjob.name"
902 ]
903 }
904 },
905 "mappings": {
906 "dynamic_templates": [
907 {
908 "kubernetes.pod.labels.*": {
909 "path_match": "kubernetes.pod.labels.*",
910 "mapping": { "type": "keyword" },
911 "match_mapping_type": "*"
912 }
913 },
914 {
915 "kubernetes.namespace.labels.*": {
916 "path_match": "kubernetes.namespace.labels.*",
917 "mapping": { "type": "keyword" },
918 "match_mapping_type": "*"
919 }
920 },
921 {
922 "kubernetes.node.labels.*": {
923 "path_match": "kubernetes.node.labels.*",
924 "mapping": { "type": "keyword" },
925 "match_mapping_type": "*"
926 }
927 },
928 {
929 "kubernetes.daemonset.labels.*": {
930 "path_match": "kubernetes.daemonset.labels.*",
931 "mapping": { "type": "keyword" },
932 "match_mapping_type": "*"
933 }
934 },
935 {
936 "kubernetes.replicaset.labels.*": {
937 "path_match": "kubernetes.replicaset.labels.*",
938 "mapping": { "type": "keyword" },
939 "match_mapping_type": "*"
940 }
941 },
942 {
943 "kubernetes.deployment.labels.*": {
944 "path_match": "kubernetes.deployment.labels.*",
945 "mapping": { "type": "keyword" },
946 "match_mapping_type": "*"
947 }
948 },
949 {
950 "kubernetes.statefulset.labels.*": {
951 "path_match": "kubernetes.statefulset.labels.*",
952 "mapping": { "type": "keyword" },
953 "match_mapping_type": "*"
954 }
955 },
956 {
957 "kubernetes.job.labels.*": {
958 "path_match": "kubernetes.job.labels.*",
959 "mapping": { "type": "keyword" },
960 "match_mapping_type": "*"
961 }
962 },
963 {
964 "kubernetes.cronjob.labels.*": {
965 "path_match": "kubernetes.cronjob.labels.*",
966 "mapping": { "type": "keyword" },
967 "match_mapping_type": "*"
968 }
969 },
970 {
971 "strings_as_keyword": {
972 "mapping": { "ignore_above": 1024, "type": "keyword" },
973 "match_mapping_type": "string"
974 }
975 }
976 ],
977 "properties": {
978 "@timestamp": { "type": "date"},
979 "message":{"type":"match_only_text"},
980 "collectord_errors": {"type": "keyword","ignore_above": 1024},
981 "input":{"properties":{"type":{"ignore_above":1024,"type":"keyword"}}},
982 "container": {"properties": {
983 "name": { "ignore_above": 1024, "type": "keyword"},
984 "id": { "ignore_above": 1024, "type": "keyword"},
985 "runtime": {"ignore_above": 1024, "type": "keyword"},
986 "image": {"properties": {
987 "name": { "ignore_above": 1024, "type": "keyword"}
988 }}
989 }
990 },
991 "event": {"properties": {
992 "id": {"ignore_above": 1024, "type": "keyword"}
993 }},
994 "host": {"properties": {
995 "name": {"ignore_above": 1024, "type": "keyword"},
996 "architecture": {"ignore_above": 1024, "type": "keyword"},
997 "hostname": {"ignore_above": 1024, "type": "keyword"}
998 }},
999 "log": { "properties": {
1000 "file": { "properties": {
1001 "path": {"ignore_above": 1024, "type": "keyword"}
1002 }},
1003 "offset": {"type": "long"},
1004 "syslog": {"properties": {
1005 "appname": {"ignore_above": 1024, "type": "keyword"},
1006 "facility": {"properties": {
1007 "code": {"type": "long"}
1008 }},
1009 "priority": {"type": "long"},
1010 "procid": {"type": "long"},
1011 "hostname": {"ignore_above": 1024, "type": "keyword"}
1012 }}
1013 }},
1014 "orchestrator": {"properties": {
1015 "cluster": {"properties": {
1016 "name": {"ignore_above": 1024, "type": "keyword"}
1017 }},
1018 "namespace": {"properties": {
1019 "name":{"path":"kubernetes.namespace.name","type":"alias"}
1020 }},
1021 "type": {"ignore_above": 1024, "type": "keyword"}
1022 }},
1023 "stream": {"ignore_above": 1024, "type": "keyword"},
1024 "agent":{"properties":{
1025 "hostname":{"path":"agent.name","type":"alias"},
1026 "name":{"ignore_above":1024,"type":"keyword"},
1027 "id":{"ignore_above":1024,"type":"keyword"},
1028 "type":{"ignore_above":1024,"type":"keyword"},
1029 "ephemeral_id":{"ignore_above":1024,"type":"keyword"},
1030 "version":{"ignore_above":1024,"type":"keyword"}
1031 }},
1032 "ecs":{"properties":{"version":{"ignore_above":1024,"type":"keyword"}}},
1033 "kubernetes": { "properties": {
1034 "container": {"properties": {
1035 "imageid": {"ignore_above": 1024, "type": "keyword"}
1036 }},
1037 "host": {"properties": {
1038 "ip": {"type": "ip"}
1039 }},
1040 "namespace": {"properties": {
1041 "name": {"ignore_above": 1024, "type": "keyword"}
1042 }},
1043 "node": { "properties": {
1044 "id": {"ignore_above": 1024, "type": "keyword"},
1045 "name": {"ignore_above": 1024,"type": "keyword"}
1046 }},
1047 "pod": {"properties": {
1048 "id": {"ignore_above": 1024,"type": "keyword"},
1049 "ip": {"type": "ip"},
1050 "name": {"ignore_above": 1024,"type": "keyword"}
1051 }},
1052 "statefulset": { "properties": {
1053 "id": {"ignore_above": 1024,"type": "keyword"},
1054 "name": {"ignore_above": 1024,"type": "keyword"}
1055 }},
1056 "replicaset": {"properties": {
1057 "id": {"ignore_above": 1024,"type": "keyword"},
1058 "name": {"ignore_above": 1024, "type": "keyword"}
1059 }},
1060 "deployment": { "properties": {
1061 "id": {"ignore_above": 1024,"type": "keyword"},
1062 "name": {"ignore_above": 1024,"type": "keyword" }
1063 }},
1064 "cronjob": {"properties": {
1065 "id": {"ignore_above": 1024,"type": "keyword"},
1066 "name": {"ignore_above": 1024, "type": "keyword"}
1067 }},
1068 "job": {"properties": {
1069 "id": {"ignore_above": 1024,"type": "keyword"},
1070 "name": {"ignore_above": 1024, "type": "keyword"}
1071 }}
1072 }},
1073 "volume": {"properties": {
1074 "name": {"ignore_above": 1024,"type": "keyword"}
1075 }}
1076 }
1077 }
1078 },
1079 "index_patterns": ["logs-collectord-${COLLECTORD_VERSION}"]
1080 }
1081 es-failed-index-template.json: |
1082 {
1083 "version": 1,
1084 "data_stream": {},
1085 "_meta": {
1086 "description": "Default template for Collectord indexes for events that failed to be ingested"
1087 },
1088 "priority": 1000,
1089 "template": {
1090 "settings": {
1091 "index": {
1092 "lifecycle": {
1093 "name": "logs-collectord"
1094 },
1095 "refresh_interval": "5s",
1096 "mapping": {
1097 "total_fields": {
1098 "limit": "10000"
1099 }
1100 },
1101 "max_docvalue_fields_search": "200"
1102 },
1103 "query": {
1104 "default_field": [
1105 "message"
1106 ]
1107 }
1108 },
1109 "mappings": {
1110 "properties": {
1111 "@timestamp": {
1112 "type": "date"},
1113 "message": {
1114 "type": "match_only_text"}
1115 }
1116 }
1117 },
1118 "index_patterns": [
1119 "logs-collectord-failed-${COLLECTORD_VERSION}"]
1120 }
1121---
1122apiVersion: apps/v1
1123kind: DaemonSet
1124metadata:
1125 name: collectorforkubernetes-elasticsearch
1126 namespace: collectorforkubernetes
1127 labels:
1128 app: collectorforkubernetes-elasticsearch
1129spec:
1130 updateStrategy:
1131 type: RollingUpdate
1132
1133 selector:
1134 matchLabels:
1135 daemon: collectorforkubernetes-elasticsearch
1136
1137 template:
1138 metadata:
1139 name: collectorforkubernetes-elasticsearch
1140 labels:
1141 daemon: collectorforkubernetes-elasticsearch
1142 spec:
1143 priorityClassName: collectorforkubernetes-critical
1144 dnsPolicy: ClusterFirstWithHostNet
1145 hostNetwork: true
1146 serviceAccountName: collectorforkubernetes
1147 tolerations:
1148 - operator: "Exists"
1149 effect: "NoSchedule"
1150 - operator: "Exists"
1151 effect: "NoExecute"
1152 containers:
1153 - name: collectorforkubernetes
1154 image: docker.io/outcoldsolutions/collectorforkubernetes:26.04.4
1155 imagePullPolicy: Always
1156 securityContext:
1157 runAsUser: 0
1158 privileged: true
1159 # Define your resources if you need. Defaults should be fine for most.
1160 # You can lower or increase based on your hosts.
1161 resources:
1162 limits:
1163 cpu: 2000m
1164 memory: 512Mi
1165 requests:
1166 cpu: 200m
1167 memory: 192Mi
1168 env:
1169 - name: KUBERNETES_NODENAME
1170 valueFrom:
1171 fieldRef:
1172 fieldPath: spec.nodeName
1173 - name: POD_NAME
1174 valueFrom:
1175 fieldRef:
1176 fieldPath: metadata.name
1177 volumeMounts:
1178 # We store state in /data folder (file positions)
1179 - name: collectorforkubernetes-state
1180 mountPath: /data
1181 # Configuration file deployed with ConfigMap
1182 - name: collectorforkubernetes-config
1183 mountPath: /config/
1184 readOnly: true
1185 # Rootfs
1186 - name: rootfs
1187 mountPath: /rootfs/
1188 readOnly: false
1189 mountPropagation: HostToContainer
1190 # correct timezone
1191 - name: localtime
1192 mountPath: /etc/localtime
1193 readOnly: true
1194 volumes:
1195 # We store state directly on host, change this location, if
1196 # your persistent volume is somewhere else
1197 - name: collectorforkubernetes-state
1198 hostPath:
1199 path: /var/lib/collectorforkubernetes-elasticsearch/data/
1200 type: DirectoryOrCreate
1201 # Location of docker root (for container logs and metadata)
1202 - name: rootfs
1203 hostPath:
1204 path: /
1205 # correct timezone
1206 - name: localtime
1207 hostPath:
1208 path: /etc/localtime
1209 # configuration from ConfigMap
1210 - name: collectorforkubernetes-config
1211 configMap:
1212 name: collectorforkubernetes-elasticsearch
1213 items:
1214 - key: 001-general.conf
1215 path: 001-general.conf
1216 - key: 002-daemonset.conf
1217 path: 002-daemonset.conf
1218 - key: es-default-index-template.json
1219 path: es-default-index-template.json
1220 - key: es-default-index-lifecycle-management-policy.json
1221 path: es-default-index-lifecycle-management-policy.json
1222 - key: es-failed-index-template.json
1223 path: es-failed-index-template.json
1224---
1225apiVersion: apps/v1
1226kind: Deployment
1227metadata:
1228 name: collectorforkubernetes-elasticsearch-addon
1229 namespace: collectorforkubernetes
1230 labels:
1231 app: collectorforkubernetes-elasticsearch
1232spec:
1233 replicas: 1
1234
1235 selector:
1236 matchLabels:
1237 daemon: collectorforkubernetes-elasticsearch
1238
1239 template:
1240 metadata:
1241 name: collectorforkubernetes-elasticsearch-addon
1242 labels:
1243 daemon: collectorforkubernetes-elasticsearch
1244 spec:
1245 priorityClassName: collectorforkubernetes-critical
1246 serviceAccountName: collectorforkubernetes
1247 containers:
1248 - name: collectorforkubernetes
1249 image: docker.io/outcoldsolutions/collectorforkubernetes:26.04.4
1250 imagePullPolicy: Always
1251 securityContext:
1252 runAsUser: 0
1253 privileged: true
1254 resources:
1255 limits:
1256 cpu: 500m
1257 memory: 256Mi
1258 requests:
1259 cpu: 50m
1260 memory: 64Mi
1261 env:
1262 - name: KUBERNETES_NODENAME
1263 valueFrom:
1264 fieldRef:
1265 fieldPath: spec.nodeName
1266 - name: POD_NAME
1267 valueFrom:
1268 fieldRef:
1269 fieldPath: metadata.name
1270 volumeMounts:
1271 - name: collectorforkubernetes-state
1272 mountPath: /data
1273 - name: collectorforkubernetes-config
1274 mountPath: /config/
1275 readOnly: true
1276 volumes:
1277 - name: collectorforkubernetes-state
1278 hostPath:
1279 path: /var/lib/collectorforkubernetes-elasticsearch/data/
1280 type: Directory
1281 - name: collectorforkubernetes-config
1282 configMap:
1283 name: collectorforkubernetes-elasticsearch
1284 items:
1285 - key: 001-general.conf
1286 path: 001-general.conf
1287 - key: 004-addon.conf
1288 path: 004-addon.conf
1289 - key: es-default-index-template.json
1290 path: es-default-index-template.json
1291 - key: es-default-index-lifecycle-management-policy.json
1292 path: es-default-index-lifecycle-management-policy.json
1293 - key: es-failed-index-template.json
1294 path: es-failed-index-template.json