Download
Link
collectorforkubernetes-elasticsearch.yaml
CURL
1curl -O https://www.outcoldsolutions.com/docs/elasticsearch-kubernetes/collectorforkubernetes-elasticsearch.yamlWGET
1wget https://www.outcoldsolutions.com/docs/elasticsearch-kubernetes/collectorforkubernetes-elasticsearch.yamlcollectorforkubernetes.yaml
1apiVersion: v1
2kind: Namespace
3metadata:
4 labels:
5 app: collectorforkubernetes
6 name: collectorforkubernetes
7---
8apiVersion: apiextensions.k8s.io/v1
9kind: CustomResourceDefinition
10metadata:
11 name: configurations.collectord.io
12spec:
13 group: collectord.io
14 versions:
15 - name: v1
16 served: true
17 storage: true
18 schema:
19 openAPIV3Schema:
20 type: object
21 properties:
22 spec:
23 type: object
24 additionalProperties: true
25 force:
26 type: boolean
27 scope: Cluster
28 names:
29 listKind: ConfigurationList
30 plural: configurations
31 singular: configuration
32 kind: Configuration
33---
34apiVersion: apiextensions.k8s.io/v1
35kind: CustomResourceDefinition
36metadata:
37 name: splunkoutputs.collectord.io
38spec:
39 group: collectord.io
40 versions:
41 - name: v1
42 served: true
43 storage: true
44 schema:
45 openAPIV3Schema:
46 type: object
47 properties:
48 spec:
49 type: object
50 properties:
51 url:
52 type: string
53 format: uri
54 insecure:
55 type: boolean
56 token:
57 type: string
58 description: "Plain token"
59 tokenFromSecret:
60 type: object
61 description: "Reference to a Kubernetes Secret"
62 properties:
63 secret:
64 type: string
65 key:
66 type: string
67 defaultMetricsIndex:
68 type: string
69 description: "Index of the metrics-index records sent through this output; empty for the token's default"
70 incorrectIndexBehavior:
71 type: string
72 description: "What happens to a record the token refuses"
73 enum: ["RedirectToDefault", "Drop", "Retry"]
74 requireExplicitIndex:
75 type: boolean
76 description: "Drop a record that carries no index instead of sending it to the token's default"
77 oneOf:
78 - required: ["token"]
79 - required: ["tokenFromSecret"]
80 scope: Namespaced
81 names:
82 listKind: SplunkOutputList
83 plural: splunkoutputs
84 singular: splunkoutput
85 kind: SplunkOutput
86---
87apiVersion: v1
88kind: ServiceAccount
89metadata:
90 labels:
91 app: collectorforkubernetes
92 name: collectorforkubernetes
93 namespace: collectorforkubernetes
94---
95apiVersion: rbac.authorization.k8s.io/v1
96kind: ClusterRole
97metadata:
98 name: collectorforkubernetes
99 labels:
100 app: collectorforkubernetes
101rules:
102 - apiGroups:
103 - ""
104 resources:
105 - events
106 - namespaces
107 - nodes
108 - nodes/metrics
109 - persistentvolumeclaims
110 - persistentvolumes
111 - pods
112 - replicationcontrollers
113 - resourcequotas
114 - services
115 verbs:
116 - get
117 - list
118 - watch
119 - apiGroups:
120 - apps
121 resources:
122 - daemonsets
123 - deployments
124 - replicasets
125 - statefulsets
126 verbs:
127 - get
128 - list
129 - watch
130 - apiGroups:
131 - batch
132 resources:
133 - cronjobs
134 - jobs
135 verbs:
136 - get
137 - list
138 - watch
139 - apiGroups:
140 - discovery.k8s.io
141 resources:
142 - endpointslices
143 verbs:
144 - get
145 - list
146 - watch
147 - apiGroups:
148 - rbac.authorization.k8s.io
149 resources:
150 - clusterroles
151 verbs:
152 - get
153 - list
154 - watch
155 - apiGroups:
156 - collectord.io
157 resources:
158 - configurations
159 - splunkoutputs
160 verbs:
161 - get
162 - list
163 - watch
164 - apiGroups: []
165 nonResourceURLs:
166 - /metrics
167 resources: []
168 verbs:
169 - get
170 - apiGroups: []
171 nonResourceURLs:
172 - /api
173 - /api/*
174 - /apis
175 - /apis/*
176 resources: []
177 verbs:
178 - get
179---
180apiVersion: rbac.authorization.k8s.io/v1
181kind: ClusterRoleBinding
182metadata:
183 name: collectorforkubernetes
184 labels:
185 app: collectorforkubernetes
186roleRef:
187 apiGroup: rbac.authorization.k8s.io
188 kind: ClusterRole
189 name: collectorforkubernetes
190subjects:
191 - kind: ServiceAccount
192 name: collectorforkubernetes
193 namespace: collectorforkubernetes
194---
195apiVersion: v1
196kind: ResourceQuota
197metadata:
198 name: collectorforkubernetes-critical-pods
199 namespace: collectorforkubernetes
200 labels:
201 app: collectorforkubernetes
202spec:
203 hard:
204 pods: 1G
205 scopeSelector:
206 matchExpressions:
207 - scopeName: PriorityClass
208 operator: In
209 values:
210 - system-cluster-critical
211 - system-node-critical
212---
213apiVersion: v1
214kind: ConfigMap
215metadata:
216 name: collectorforkubernetes-elasticsearch
217 namespace: collectorforkubernetes
218 labels:
219 app: collectorforkubernetes-elasticsearch
220data:
221 001-general.conf: |222 # The general configuration is used for all deployments
223 #
224 # Run collectord with the flag -conf and specify location of the configuration files.
225 #
226 # You can override all the values using environment variables with the format like
227 # COLLECTOR__<ANYNAME>=<section>__<key>=<value>
228 # As an example you can set dataPath in [general] section as
229 # COLLECTOR__DATAPATH=general__dataPath=C:\\some\\path\\data.db
230 # This parameter can be configured using -env-override, set it to empty string to disable this feature
231
232 [general]
233
234 # Please review license https://www.outcoldsolutions.com/legal/license-agreement/
235 # and accept license by changing the value to *true*
236 acceptLicense = false
237
238 # Location for the database
239 # Collectord stores positions of the files and internal state
240 dataPath = ./data/
241
242 # log level (accepted values are trace, debug, info, warn, error, fatal)
243 logLevel = info
244
245 # Internal http server - serves the liveness (/healthz) and readiness (/readyz)
246 # probes. DaemonSets run on the host network, so bind to loopback (127.0.0.1:11888)
247 # to keep the endpoints off the node IP; the kubelet still reaches them via
248 # httpGet.host 127.0.0.1. The addon runs off the host network and overrides the
249 # bind to 0.0.0.0 in 004-addon.conf so the kubelet can reach it on the pod IP.
250 # httpServerBinding = 0.0.0.0:11888
251 httpServerBinding = 127.0.0.1:11891
252 httpServerEndpoints.health = true
253 httpServerEndpoints.ready = true
254 httpServerEndpoints.metrics = false
255 httpServerEndpoints.pprof = false
256
257 httpServerLog = false
258
259 # telemetry report endpoint, set it to empty string to disable telemetry
260 telemetryEndpoint = https://license.outcold.solutions/telemetry/
261
262 licenseEndpoint = https://license.outcold.solutions/license/
263
264 # Only for the Outcold Solutions License Server; one on-premises uses [license.client]
265 licenseServerProxyUrl =
266
267 # user:password
268 licenseServerProxyBasicAuth =
269
270 license =
271
272 # Environment variable $KUBERNETES_NODENAME is used by default to setup hostname
273 # Use value below to override specific name
274 hostname =
275
276 # Default output for events, logs and metrics
277 # valid values: splunk and devnull
278 # Use devnull by default if you don't want to redirect data
279 defaultOutput = elasticsearch
280
281 fileInputBufferSize = 8kb
282
283 fileInputLineMaxSize = 1mb
284
285 # Include custom fields to attach to every event, in example below every event sent to Splunk will hav
286 # indexed field my_environment=dev. Fields names should match to ^[a-z][_a-z0-9]*$
287 # Better way to configure that is to specify labels for Kubernetes Nodes.
288 # ; fields.my_environment = dev
289 # Identify the cluster if you are planning to monitor multiple clusters
290 fields.agent.ephemeral_id = ${COLLECTORD_INSTANCE_RUNTIME_ID}
291 fields.agent.id = ${COLLECTORD_INSTANCE_ID}
292 fields.agent.name = ${KUBERNETES_NODENAME}
293 fields.agent.type = collectord
294 fields.agent.version = ${COLLECTORD_VERSION}
295 fields.ecs.version = 8.0.0
296 fields.host.architecture = ${COLLECTORD_ARCH}
297 fields.host.hostname = ${KUBERNETES_NODENAME}
298 fields.host.name = ${KUBERNETES_NODENAME}
299 fields.orchestrator.cluster.name = -
300 fields.orchestrator.type = kubernetes
301
302 # Include EC2 Metadata (see list of possible fields https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html)
303 # Should be in format ec2Metadata.{desired_field_name} = {url path to read the value}
304 # ec2Metadata.ec2_instance_id = /latest/meta-data/instance-id
305 # ec2Metadata.ec2_instance_type = /latest/meta-data/instance-type
306
307 # subdomain for the annotations added to the pods, workloads, namespaces or containers, like splunk.collectord.io/..
308 annotationsSubdomain = elasticsearch
309
310 # configure global thruput per second for forwarded logs (metrics are not included)
311 # for example if you set `thruputPerSecond = 512Kb`, that will limit amount of logs forwarded
312 # from the single Collectord instance to 512Kb per second.
313 # You can configure thruput individually for the logs (including specific for container logs) below
314 thruputPerSecond =
315
316 # Configure events that are too old to be forwarded, for example 168h (7 days) - that will drop all events
317 # older than 7 days
318 tooOldEvents =
319
320 # Configure events that are too new to be forwarded, for example 1h - that will drop all events that are 1h in future
321 tooNewEvents =
322
323 # How Collectord spells the fields it composes: "_" (kubernetes_pod_name, the default) or "."
324 fieldsSeparator =
325
326 # For input.files::X and application logs, when glob or match are configured, Collectord can automatically
327 # detect gzipped files and skip them (based on the extensions or magic numbers)
328 autoSkipGzipFiles = true
329
330 # Publish to non-default outputs asynchronously (default), so a slow or down output does not
331 # block the others; false holds the pipeline back instead of dropping events.
332 multioutput.async = true
333
334 # Buffer size for the async proxy (default 100), per output of each pipeline. When it and
335 # the output's queue are full, events are dropped (multioutput_dropped_events).
336 multioutput.asyncBufferSize = 100
337
338 [license.client]
339 # point to the license located on the HTTP web server, or a hosted by the Collectord running as license server
340 url =
341 basicAuth =
342 insecure = false
343 capath =
344 caname =
345 proxyUrl =
346
347 # user:password
348 proxyBasicAuth =
349
350 [general.kubernetes]
351
352 # Override service URL for Kubernetes (default is ${KUBERNETES_SERVICE_HOST}:${KUBERNETES_SERVICE_PORT})
353 serviceURL =
354
355 # Environment variable $KUBERNETES_NODENAME is used by default to setup nodeName
356 # Use it only when you need to override it
357 nodeName =
358
359 tokenPath = /var/run/secrets/kubernetes.io/serviceaccount/token
360 certPath = /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
361
362 # Default timeout for http responses. The streaming/watch requests depend on this timeout.
363 timeout = 30m
364
365 # How long to keep the cache for the recent calls to API server (to limit number of calls when collectord discovers new pods)
366 metadataTTL = 30s
367
368 podsCgroupFilter = ^/([^/\s]+/)*kubepods(\.slice)?/((kubepods-)?(burstable|besteffort)(\.slice)?/)?([^/]*)pod([0-9a-f]{32}|[0-9a-f\-_]{36})(\.slice)?$
369
370 containersCgroupFilter = ^/([^/\s]+/)*kubepods(\.slice)?/((kubepods-)?(burstable|besteffort)(\.slice)?/)?([^/]*)pod([0-9a-f]{32}|[0-9a-f\-_]{36})(\.slice)?/(docker-|crio-|cri-\w+-)?[0-9a-f]{64}(\.scope)?(\/.+)?$
371
372 # path to the kubelet root location (use it to discover application logs for emptyDir)
373 # the expected format is `pods/{pod-id}/volumes/kubernetes.io~empty-dir/{volume-name}/_data/`
374 volumesRootDir = /rootfs/var/lib/kubelet/
375
376 # You can attach annotations as a metadata, using the format
377 # includeAnnotations.{key} = {regexp}
378 # For example if you want to include all annotations that starts with `prometheus.io` or `example.com` you can include
379 # the following format:
380 # includeAnnotations.1 = ^prometheus\.io.*
381 # includeAnnotations.2 = ^example\.com.*
382
383 # You can exclude labels from metadata, using the format
384 # excludeLabels.{key} = {regexp}
385 # For example if you want to exclude all labels that starts with `prometheus.io` or `example.com` you can include
386 # the following format:
387 # excludeLabels.1 = ^prometheus\.io.*
388 # excludeLabels.2 = ^example\.com.*
389
390 # watch for changes (annotations) in the objects
391 watch.namespace = v1/namespace
392 watch.deployment = apps/v1/deployment
393 watch.configuration = collectord.io/v1/configuration
394
395 # Collectord can review the assigned ClusterRole and traverse metadata for the Pods only for the Owner objects
396 # that are defined in the ClusterRole, ignoring anything else, it does not have access to.
397 # This way Collectord does not generate 403 requests on API Server
398 clusterRole = collectorforkubernetes
399
400 # Alternative of telling Collectord about the ClusterRole is to manually list the objects.
401 # You can define which objects Collectord should traverse when it sees Owners.
402 ; traverseOwnership.namespaces = v1/namespace
403
404 [output.elasticsearch]
405
406 dataStream = logs-collectord-{{agent.version}}
407 dataStreamFailedEvents = logs-collectord-failed-{{agent.version}}
408
409 # ElasticSearch Scheme Host and Port, with an optional path every request goes under
410 # (https://gateway/elasticsearch, behind a reverse proxy)
411 host =
412
413 # Specify how Hosts should be picked up (in case if multiple is used)
414 # * random - choose random url on first selection and a different random one after each failure (connection or HTTP status code >= 500)
415 # * round-robin - choose url starting from first one and bump on each failure (connection or HTTP status code >= 500)
416 # * random-with-round-robin - choose random url on first selection and after that in round-robin on each
417 # failure (connection or HTTP status code >= 500)
418 # With round-robin and random-with-round-robin, the instances on a failed url can all move to the same next one.
419 hostSelection = random
420 authorizationBasicUsername =
421 authorizationBasicPassword =
422 headers.Accept = application/json
423 headers.Content-Type = application/json
424 insecure = false
425 caPath =
426 caName =
427 clientCertPath =
428 clientKeyPath =
429
430 # Events are batched with the maximum size set by batchSize and staying in a pipeline for not longer
431 # than set by frequency
432 frequency = 5s
433 batchSize = 768K
434
435 # limit by the number of events (0 value has no limit on the number of events)
436 events = 50
437 proxyUrl =
438
439 # user:password
440 proxyBasicAuth =
441
442 # Timeout specifies a time limit for requests made by collectord.
443 # The timeout includes connection time, any
444 # redirects, and reading the response body.
445 timeout = 30s
446
447 # gzip compression level (nocompression, default, 1...9)
448 compressionLevel = default
449
450 # number of dedicated elasticsearch output threads (to increase throughput above 4k events per second)
451 threads = 2
452
453 # Default algorithm between threads is roundrobin, but you can change it to weighted
454 threadsAlgorithm = weighted
455
456 # Submit objects to elasticsearch
457 put._ilm/policy/logs-collectord = /config/es-default-index-lifecycle-management-policy.json
458 put._index_template/logs-collectord-${COLLECTORD_VERSION} = /config/es-default-index-template.json
459 put._index_template/logs-collectord-failed-${COLLECTORD_VERSION} = /config/es-failed-index-template.json
460
461 # Dedicated queue size for the output, default is 1024, larger queue sizes will require more memory,
462 # but will allow to handle more events in case of network issues
463 queueSize = 1024464 002-daemonset.conf: | 465 [general.cri-o]
466
467 # url for CRIO API, only unix socket is supported
468 url = unix:///rootfs/var/run/crio/crio.sock
469
470 # Timeout for http responses to docker client. The streaming requests depend on this timeout.
471 timeout = 1m
472
473 [general.containerd]
474 # Runtime can be on /rootfs/run/containerd (depends on the Linux distribution)
475 runtimePath = /rootfs/var/run/containerd
476 namespace = k8s.io
477
478 [input.files]
479
480 disabled = false
481
482 # root location of docker log files
483 # logs are expected in standard docker format like {containerID}/{containerID}-json.log
484 # rotated files
485 path = /rootfs/var/lib/docker/containers/
486
487 # root location of CRI-O files
488 # logs are expected in Kubernetes format, like {podID}/{containerName}/0.log
489 crioPath = /rootfs/var/log/pods/
490
491 # files are read using polling schema, when reach the EOF how often to check if files got updated
492 pollingInterval = 250ms
493
494 # how often to look for the new files under logs path
495 walkingInterval = 5s
496
497 # include verbose fields in events (file offset)
498 verboseFields = false
499
500 type = container
501
502 elasticsearch.datastream =
503
504 # docker splits events when they are larger than 10-100k (depends on the docker version)
505 # we join them together by default and forward to Splunk as one event
506 joinPartialEvents = true
507
508 # In case if your containers report messages with terminal colors or other escape sequences
509 # you can enable strip for all the containers in one place.
510 # Better is to enable it only for required container with the annotation elasticsearch.collectord.io/logs-escapeterminalsequences=true
511 stripTerminalEscapeSequences = false
512
513 # Regexp used for stripping terminal colors, it does not stip all the escape sequences
514 # Read http://man7.org/linux/man-pages/man4/console_codes.4.html for more information
515 stripTerminalEscapeSequencesRegex = (\x1b\[\d{1,3}(;\d{1,3})*m)|(\x07)|(\x1b]\d+(\s\d)?;[^\x07]+\x07)|(.*\x1b\[K)
516
517 # sample output (-1 does not sample, 20 - only 20% of the logs should be forwarded)
518 samplingPercent = -1
519
520 # sampling key for hash based sampling (should be regexp with the named match pattern `key`)
521 samplingKey =
522
523 output =
524
525 # configure default thruput per second for for each container log
526 # for example if you set `thruputPerSecond = 128Kb`, that will limit amount of logs forwarded
527 # from the single container to 128Kb per second.
528 thruputPerSecond =
529
530 # Configure events that are too old to be forwarded, for example 168h (7 days) - that will drop all events
531 # older than 7 days
532 tooOldEvents =
533
534 # Configure events that are too new to be forwarded, for example 1h - that will drop all events that are 1h in future
535 tooNewEvents =
536
537 # Read rotated logs the kubelet compressed before Collectord read them; false counts them lost
538 readCompressed = true
539
540 # Bytes of those logs inflated at once, node-wide, under [general] dataPath
541 compressedInflateBudget = 256MiB
542
543 # Group each stream's repeated lines into one event per run that counts them.
544 # Off unless true; a workload overrides it with its
545 # elasticsearch.collectord.io/logs-repeat-enabled annotation.
546 repeatEnabled = false
547
548 # How long a run is held before its event goes out, up to 10m (a crash resends up to that much)
549 # repeatMaxSpan = 1m
550
551 # Add every line's time to a run's event (collectord_repeat_offsets, milliseconds from its own)
552 # repeatOffsets = false
553
554 # What each stream may remember: distinct lines, lines one event stands for, and bytes
555 # repeatMaxKeys = 256
556 # repeatMaxCount = 1000
557 # repeatMaxBytes = 256KB
558
559 # Fold each stream's lines of one pattern past foldMaxPerMinute into one summary a minute.
560 # Lossy: folded lines are not sent. Off unless true; a workload overrides it with its
561 # elasticsearch.collectord.io/logs-fold-enabled annotation.
562 foldEnabled = false
563
564 # Lines of one pattern a minute sent before the rest fold
565 # foldMaxPerMinute = 60
566
567 # Lines never folded (a regular expression; empty: the default)
568 # foldKeep = (?i)error|exception|fatal|panic
569
570 # What each stream may keep a minute: its patterns and summaries
571 # foldMaxBytes = 256KB
572
573 # Report each stream's top patterns every interval, as events of their own.
574 # Off unless true; a workload overrides it with its
575 # elasticsearch.collectord.io/logs-patterns-enabled annotation.
576 patternsEnabled = false
577
578 # How often a report goes out, from 1m to 24h
579 # patternsInterval = 15m
580
581 # How many patterns a report carries, up to 100
582 # patternsTop = 20
583
584 # What each stream's patterns may keep; past it a new one takes the place of the lightest
585 # patternsMaxBytes = 256KB
586
587 # The report events' type (empty: the input's type with _patterns after it)
588 # patternsType =
589
590 [input.app_logs]
591
592 disabled = false
593
594 # root location of mounts (applies to hostPath mounts only), if the hostPath differs inside container from the path on host
595 root = /rootfs/
596
597 # how often to review list of available volumes
598 syncInterval = 5s
599
600 glob = *.log*
601
602 # files are read using polling schema, when reach the EOF how often to check if files got updated
603 pollingInterval = 250ms
604
605 # how often to look for the new files under logs path
606 walkingInterval = 5s
607
608 # include verbose fields in events (file offset)
609 verboseFields = false
610
611 type = container.file
612
613 elasticsearch.datastream =
614
615 # we split files using new line character, with this configuration you can specify what defines the new event
616 # after new line
617 eventPatternRegex = ^[^\s]
618 eventPatternMaxInterval = 100ms
619 eventPatternMaxWait = 1s
620 eventPatternMaxSize = 1MB
621
622 # sample output (-1 does not sample, 20 - only 20% of the logs should be forwarded)
623 samplingPercent = -1
624
625 # sampling key for hash based sampling (should be regexp with the named match pattern `key`)
626 samplingKey =
627
628 output =
629
630 # configure default thruput per second for for each container log
631 # for example if you set `thruputPerSecond = 128Kb`, that will limit amount of logs forwarded
632 # from the single container to 128Kb per second.
633 thruputPerSecond =
634
635 # Configure events that are too old to be forwarded, for example 168h (7 days) - that will drop all events
636 # older than 7 days
637 tooOldEvents =
638
639 # Configure events that are too new to be forwarded, for example 1h - that will drop all events that are 1h in future
640 tooNewEvents =
641
642 # Configure how long Collectord should keep the file descriptors open for files, that has not been forwarded yet
643 # When using PVC, and if pipeline is lagging behind, Collectord holding open fd for files, can cause long termination
644 # of pods, as kubelet cannot unmount the PVC volume from the system
645 maxHoldAfterClose = 1800s
646
647 # Group each file's repeated lines into one event per run that counts them.
648 # Off unless true; a workload overrides it with its
649 # elasticsearch.collectord.io/volume.<n>-logs-repeat-enabled annotation.
650 repeatEnabled = false
651
652 # How long a run is held before its event goes out, up to 10m (a crash resends up to that much)
653 # repeatMaxSpan = 1m
654
655 # Add every line's time to a run's event (collectord_repeat_offsets, milliseconds from its own)
656 # repeatOffsets = false
657
658 # What each file may remember: distinct lines, lines one event stands for, and bytes
659 # repeatMaxKeys = 256
660 # repeatMaxCount = 1000
661 # repeatMaxBytes = 256KB
662
663 # Fold each file's lines of one pattern past foldMaxPerMinute into one summary a minute.
664 # Lossy: folded lines are not sent. Off unless true; a workload overrides it with its
665 # elasticsearch.collectord.io/volume.<n>-logs-fold-enabled annotation.
666 foldEnabled = false
667
668 # Lines of one pattern a minute sent before the rest fold
669 # foldMaxPerMinute = 60
670
671 # Lines never folded (a regular expression; empty: the default)
672 # foldKeep = (?i)error|exception|fatal|panic
673
674 # What each file may keep a minute: its patterns and summaries
675 # foldMaxBytes = 256KB
676
677 # Report each file's top patterns every interval, as events of their own.
678 # Off unless true; a workload overrides it with its
679 # elasticsearch.collectord.io/volume.<n>-logs-patterns-enabled annotation.
680 patternsEnabled = false
681
682 # How often a report goes out, from 1m to 24h
683 # patternsInterval = 15m
684
685 # How many patterns a report carries, up to 100
686 # patternsTop = 20
687
688 # What each file's patterns may keep; past it a new one takes the place of the lightest
689 # patternsMaxBytes = 256KB
690
691 # The report events' type (empty: the input's type with _patterns after it)
692 # patternsType =
693
694 [input.files::audit-logs]
695
696 disabled = false
697
698 path = /rootfs/var/log/kube-apiserver/
699
700 glob = audit*.log
701
702 match =
703
704 # limit search only on one level
705 recursive = false
706 nodeSelector = node-role.kubernetes.io/control-plane
707
708 # files are read using polling schema, when reach the EOF how often to check if files got updated
709 pollingInterval = 250ms
710
711 # how often o look for the new files under logs path
712 walkingInterval = 5s
713
714 # include verbose fields in events (file offset)
715 verboseFields = false
716
717 type = file
718
719 elasticsearch.datastream =
720
721 extraction = (?P<message>.*"stageTimestamp":"(?P<timestamp>[^"]+)".*)
722 extractionMessageField = message
723
724 timestampField = timestamp
725
726 # format for timestamp
727 # the layout defines the format by showing how the reference time, defined to be `Mon Jan 2 15:04:05 -0700 MST 2006`
728 timestampFormat = 2006-01-02T15:04:05.999999999Z07:00
729
730 # timestamp location (if not defined by format)
731 timestampLocation =
732
733 # sample output (-1 does not sample, 20 - only 20% of the logs should be forwarded)
734 samplingPercent = -1
735
736 # sampling key for hash based sampling (should be regexp with the named match pattern `key`)
737 samplingKey =
738
739 output =
740
741 # configure default thruput per second for this files group
742 # for example if you set `thruputPerSecond = 128Kb`, that will limit amount of logs forwarded
743 # from the files in this group to 128Kb per second.
744 thruputPerSecond =
745
746 # Configure events that are too old to be forwarded, for example 168h (7 days) - that will drop all events
747 # older than 7 days
748 tooOldEvents =
749
750 # Configure events that are too new to be forwarded, for example 1h - that will drop all events that are 1h in future
751 tooNewEvents =
752
753 # by default every new event should start from not space symbol
754 eventPattern =
755
756 # Blacklisting and whitelisting the logs
757 # whitelist.0 = ^regexp$
758 # blacklist.0 = ^regexp$
759
760 # Lines matching a thruputExempt pattern pass every thruput cap and sampling; with one set,
761 # a spent cap drops the other lines instead of pausing this input
762 # thruputExempt.0 = ^regexp$
763
764 # Group each file's repeated lines into one event per run that counts them.
765 # Off unless true.
766 repeatEnabled = false
767
768 # How long a run is held before its event goes out, up to 10m (a crash resends up to that much)
769 # repeatMaxSpan = 1m
770
771 # Add every line's time to a run's event (collectord_repeat_offsets, milliseconds from its own)
772 # repeatOffsets = false
773
774 # What each file may remember: distinct lines, lines one event stands for, and bytes
775 # repeatMaxKeys = 256
776 # repeatMaxCount = 1000
777 # repeatMaxBytes = 256KB
778
779 # Fold each file's lines of one pattern past foldMaxPerMinute into one summary a minute.
780 # Lossy: folded lines are not sent. Off unless true.
781 foldEnabled = false
782
783 # Lines of one pattern a minute sent before the rest fold
784 # foldMaxPerMinute = 60
785
786 # Lines never folded (a regular expression; empty: the default)
787 # foldKeep = (?i)error|exception|fatal|panic
788
789 # What each file may keep a minute: its patterns and summaries
790 # foldMaxBytes = 256KB
791
792 # Report each file's top patterns every interval, as events of their own.
793 # Off unless true.
794 patternsEnabled = false
795
796 # How often a report goes out, from 1m to 24h
797 # patternsInterval = 15m
798
799 # How many patterns a report carries, up to 100
800 # patternsTop = 20
801
802 # What each file's patterns may keep; past it a new one takes the place of the lightest
803 # patternsMaxBytes = 256KB
804
805 # The report events' type (empty: the input's type with _patterns after it)
806 # patternsType =
807
808 [input.files::logs]
809
810 disabled = false
811
812 path = /rootfs/var/log/
813
814 glob =
815
816 match = ^(([\w\-.]+\.log(.[\d\-]+)?)|(docker))$
817 exclude = ^(auth|cron|daemon|kern|lpr|mail|user|ufw)\.log(.[\d\-]+)?$
818
819 # limit search only on one level
820 recursive = false
821
822 # files are read using polling schema, when reach the EOF how often to check if files got updated
823 pollingInterval = 250ms
824
825 # how often o look for the new files under logs path
826 walkingInterval = 5s
827
828 # include verbose fields in events (file offset)
829 verboseFields = false
830
831 type = file
832
833 elasticsearch.datastream =
834
835 extraction =
836 extractionMessageField =
837
838 timestampField =
839
840 # format for timestamp
841 # the layout defines the format by showing how the reference time, defined to be `Mon Jan 2 15:04:05 -0700 MST 2006`
842 timestampFormat =
843
844 # Adjust date, if month/day aren't set in format
845 timestampSetMonth = false
846 timestampSetDay = false
847
848 # timestamp location (if not defined by format)
849 timestampLocation =
850
851 # sample output (-1 does not sample, 20 - only 20% of the logs should be forwarded)
852 samplingPercent = -1
853
854 # sampling key for hash based sampling (should be regexp with the named match pattern `key`)
855 samplingKey =
856
857 output =
858
859 # configure default thruput per second for this files group
860 # for example if you set `thruputPerSecond = 128Kb`, that will limit amount of logs forwarded
861 # from the files in this group to 128Kb per second.
862 thruputPerSecond =
863
864 # Configure events that are too old to be forwarded, for example 168h (7 days) - that will drop all events
865 # older than 7 days
866 tooOldEvents =
867
868 # Configure events that are too new to be forwarded, for example 1h - that will drop all events that are 1h in future
869 tooNewEvents =
870
871 # by default every new event should start from not space symbol
872 eventPattern = ^[^\s]
873
874 # Blacklisting and whitelisting the logs
875 # whitelist.0 = ^regexp$
876 # blacklist.0 = ^regexp$
877
878 # Lines matching a thruputExempt pattern pass every thruput cap and sampling; with one set,
879 # a spent cap drops the other lines instead of pausing this input
880 # thruputExempt.0 = ^regexp$
881
882 # Group each file's repeated lines into one event per run that counts them.
883 # Off unless true.
884 repeatEnabled = false
885
886 # How long a run is held before its event goes out, up to 10m (a crash resends up to that much)
887 # repeatMaxSpan = 1m
888
889 # Add every line's time to a run's event (collectord_repeat_offsets, milliseconds from its own)
890 # repeatOffsets = false
891
892 # What each file may remember: distinct lines, lines one event stands for, and bytes
893 # repeatMaxKeys = 256
894 # repeatMaxCount = 1000
895 # repeatMaxBytes = 256KB
896
897 # Fold each file's lines of one pattern past foldMaxPerMinute into one summary a minute.
898 # Lossy: folded lines are not sent. Off unless true.
899 foldEnabled = false
900
901 # Lines of one pattern a minute sent before the rest fold
902 # foldMaxPerMinute = 60
903
904 # Lines never folded (a regular expression; empty: the default)
905 # foldKeep = (?i)error|exception|fatal|panic
906
907 # What each file may keep a minute: its patterns and summaries
908 # foldMaxBytes = 256KB
909
910 # Report each file's top patterns every interval, as events of their own.
911 # Off unless true.
912 patternsEnabled = false
913
914 # How often a report goes out, from 1m to 24h
915 # patternsInterval = 15m
916
917 # How many patterns a report carries, up to 100
918 # patternsTop = 20
919
920 # What each file's patterns may keep; past it a new one takes the place of the lightest
921 # patternsMaxBytes = 256KB
922
923 # The report events' type (empty: the input's type with _patterns after it)
924 # patternsType =
925
926 [input.files::syslog]
927
928 disabled = true
929
930 path = /rootfs/var/log/
931
932 glob =
933
934 match = ^(syslog|messages|auth\.log)(.[\d\-]+)?$
935
936 # limit search only on one level
937 recursive = false
938
939 # files are read using polling schema, when reach the EOF how often to check if files got updated
940 pollingInterval = 250ms
941
942 # how often o look for the new files under logs path
943 walkingInterval = 5s
944
945 # include verbose fields in events (file offset)
946 verboseFields = false
947
948 type = file
949
950 elasticsearch.datastream =
951
952 extraction = ^(?P<timestamp>[A-Za-z]+\s+\d+\s\d+:\d+:\d+|\d{4}-\d{2}-\d{2}T\S+)\s(?P<log__syslog__hostname>[^\s]+)\s(?P<log__syslog__appname>[^:\[]+)(\[(?P<log__syslog__procid>\d+)\])?: (.+)$
953 extractionMessageField =
954
955 # the extracted fields naming the process that wrote a line, which groups its lines apart
956 extractionWriterFields = log__syslog__hostname, log__syslog__appname, log__syslog__procid
957
958 timestampField = timestamp
959
960 # format for timestamp
961 # the layout defines the format by showing how the reference time, defined to be `Mon Jan 2 15:04:05 -0700 MST 2006`
962 timestampFormat = @syslog
963
964 # Adjust date, if month/day aren't set in format
965 timestampSetMonth = false
966 timestampSetDay = false
967
968 # timestamp location (if not defined by format)
969 timestampLocation = Local
970
971 # sample output (-1 does not sample, 20 - only 20% of the logs should be forwarded)
972 samplingPercent = -1
973
974 # sampling key for hash based sampling (should be regexp with the named match pattern `key`)
975 samplingKey =
976
977 output =
978
979 # configure default thruput per second for this files group
980 # for example if you set `thruputPerSecond = 128Kb`, that will limit amount of logs forwarded
981 # from the files in this group to 128Kb per second.
982 thruputPerSecond =
983
984 # Configure events that are too old to be forwarded, for example 168h (7 days) - that will drop all events
985 # older than 7 days
986 tooOldEvents =
987
988 # Configure events that are too new to be forwarded, for example 1h - that will drop all events that are 1h in future
989 tooNewEvents =
990
991 # by default every new event should start from not space symbol
992 eventPattern = ^[^\s]
993
994 # Blacklisting and whitelisting the logs
995 # whitelist.0 = ^regexp$
996 # blacklist.0 = ^regexp$
997
998 # Lines matching a thruputExempt pattern pass every thruput cap and sampling; with one set,
999 # a spent cap drops the other lines instead of pausing this input
1000 # thruputExempt.0 = ^regexp$
1001
1002 # Group each file's repeated lines into one event per run that counts them.
1003 # Off unless true.
1004 repeatEnabled = false
1005
1006 # How long a run is held before its event goes out, up to 10m (a crash resends up to that much)
1007 # repeatMaxSpan = 1m
1008
1009 # Add every line's time to a run's event (collectord_repeat_offsets, milliseconds from its own)
1010 # repeatOffsets = false
1011
1012 # What each file may remember: distinct lines, lines one event stands for, and bytes
1013 # repeatMaxKeys = 256
1014 # repeatMaxCount = 1000
1015 # repeatMaxBytes = 256KB
1016
1017 # Fold each file's lines of one pattern past foldMaxPerMinute into one summary a minute.
1018 # Lossy: folded lines are not sent. Off unless true.
1019 foldEnabled = false
1020
1021 # Lines of one pattern a minute sent before the rest fold
1022 # foldMaxPerMinute = 60
1023
1024 # Lines never folded (a regular expression; empty: the default)
1025 # foldKeep = (?i)error|exception|fatal|panic
1026
1027 # What each file may keep a minute: its patterns and summaries
1028 # foldMaxBytes = 256KB
1029
1030 # Report each file's top patterns every interval, as events of their own.
1031 # Off unless true.
1032 patternsEnabled = false
1033
1034 # How often a report goes out, from 1m to 24h
1035 # patternsInterval = 15m
1036
1037 # How many patterns a report carries, up to 100
1038 # patternsTop = 20
1039
1040 # What each file's patterns may keep; past it a new one takes the place of the lightest
1041 # patternsMaxBytes = 256KB
1042
1043 # The report events' type (empty: the input's type with _patterns after it)
1044 # patternsType =
1045
1046 [input.journald]
1047
1048 disabled = false
1049
1050 path.persistent = /rootfs/var/log/journal/
1051 path.volatile = /rootfs/run/log/journal/
1052
1053 # when reach end of journald, how often to pull
1054 pollingInterval = 250ms
1055
1056 # if you don't want to forward journald from the beginning,
1057 # set the oldest event in relative value, like -14h or -30m or -30s (h/m/s supported)
1058 startFromRel =
1059
1060 type = journald
1061
1062 elasticsearch.datastream =
1063
1064 # sample output (-1 does not sample, 20 - only 20% of the logs should be forwarded)
1065 samplingPercent = -1
1066
1067 # sampling key (should be regexp with the named match pattern `key`)
1068 samplingKey =
1069
1070 # how often to reopen the journald to free old files
1071 reopenInterval = 1h
1072
1073 output =
1074
1075 # configure default thruput per second for journald
1076 # for example if you set `thruputPerSecond = 128Kb`, that will limit amount of logs forwarded
1077 # from the journald to 128Kb per second.
1078 thruputPerSecond =
1079
1080 # Configure events that are too old to be forwarded, for example 168h (7 days) - that will drop all events
1081 # older than 7 days
1082 tooOldEvents =
1083
1084 # Configure events that are too new to be forwarded, for example 1h - that will drop all events that are 1h in future
1085 tooNewEvents =
1086
1087 # by default every new event should start from not space symbol
1088 eventPattern = ^[^\s]
1089
1090 # By default ignoring verbose hyperkube logs (all INFO messages)
1091
1092 # Lines matching a thruputExempt pattern pass every thruput cap and sampling; with one set,
1093 # a spent cap drops the other lines instead of pausing journald
1094
1095 # Move Journald logs reader to a separate process, to prevent process from crashing in case of corrupted log files
1096 spawnExternalProcess = false
1097
1098 # Group each writer's repeated lines into one event per run that counts them.
1099 # Off unless true.
1100 # A writer is a unit, identifier, command, process, priority and facility: never grouped with another.
1101 repeatEnabled = false
1102
1103 # How long a run is held before its event goes out, up to 10m (a crash resends up to that much)
1104 # repeatMaxSpan = 1m
1105
1106 # Add every line's time to a run's event (collectord_repeat_offsets, milliseconds from its own)
1107 # repeatOffsets = false
1108
1109 # What the journal, all its writers together, may remember: distinct lines, lines one event stands for, and bytes
1110 # repeatMaxKeys = 256
1111 # repeatMaxCount = 1000
1112 # repeatMaxBytes = 256KB
1113
1114 # Fold each writer's lines of one pattern past foldMaxPerMinute into one summary a minute.
1115 # Lossy: folded lines are not sent. Off unless true.
1116 # A writer is a unit, identifier, command, process, priority and facility: never folded with another.
1117 foldEnabled = false
1118
1119 # Lines of one pattern a minute sent before the rest fold
1120 # foldMaxPerMinute = 60
1121
1122 # Lines never folded (a regular expression; empty: the default)
1123 # foldKeep = (?i)error|exception|fatal|panic
1124
1125 # What the journal, all its writers together, may keep a minute: its patterns and summaries
1126 # foldMaxBytes = 256KB
1127
1128 # Report the journal's top patterns every interval, as events of their own.
1129 # Off unless true.
1130 # A writer is a unit, identifier, command, process, priority and facility: its lines never share a pattern with another's, and the top patterns are of all its writers together.
1131 patternsEnabled = false
1132
1133 # How often a report goes out, from 1m to 24h
1134 # patternsInterval = 15m
1135
1136 # How many patterns a report carries, up to 100
1137 # patternsTop = 20
1138
1139 # What the journal's patterns may keep; past it a new one takes the place of the lightest
1140 # patternsMaxBytes = 256KB
1141
1142 # The report events' type (empty: the input's type with _patterns after it)
1143 # patternsType =
1144
1145 # Pipe to join events (container logs only)
1146 [pipe.join]
1147
1148 disabled = false
1149
1150 maxInterval = 100ms
1151
1152 maxWait = 1s
1153
1154 maxSize = 1MB
1155
1156 # Default pattern to indicate new message (should start not from space)
1157 patternRegex = ^[^\s]
1158
1159 # You can configure global replace rules for the events, which can help to remove sensitive data
1160 # from logs before they are sent to outputs. Those rules will be applied to all pipelines for container logs, host logs,
1161 # application logs and events.
1162 # In the following example we replace password=TEST with password=********
1163 ; [pipe.replace::name]
1164 ; patternRegex = (password=)([^\s]+)
1165 ; replace = $1********
1166
1167 # You can configure global hash rules for the events, which can help to hide sensitive data
1168 # from logs before they are sent to outputs. Those rules will be applied to all pipelines for container logs, host logs,
1169 # application logs and events.
1170 # In the following example we hash IP addresses with fnv-1a-64
1171 ; [pipe.hash::name]
1172 ; match = (\d{1,3}\.){3}\d{1,3}'
1173 ; function = fnv-1a-64
1174
1175 # Log lines matching patternRegex pass every thruput cap and sampling, in the workloads whose
1176 # fields match every matchRegex.<field>; over its cap such a workload drops its other lines
1177 # instead of pausing. Select by namespace: pod, container and image names are the workload
1178 # owner's to choose, and label fields never match
1179 ; [pipe.thruput_exempt::payments-audit]
1180 ; matchRegex.kubernetes_namespace = ^payments$
1181 ; patternRegex = ^AUDIT
1182
1183 # Count the events and bytes leaving every pipeline (pipeline_events, pipeline_bytes);
1184 # maxSeries bounds the label combinations. Fields are written with underscores.
1185 ; [pipe.eventcount]
1186 ; labels = index, sourcetype, output
1187 ; fields = kubernetes_namespace_name
1188 ; maxSeries = 10001189 004-addon.conf: |1190 [general]
1191 # addons can be run in parallel with agents
1192 addon = true
1193
1194 # The addon runs off the host network, so the kubelet probes /healthz and /readyz
1195 # on the pod IP - bind 0.0.0.0 here (overrides the loopback default in
1196 # 001-general.conf), on the port that binding names.
1197 httpServerBinding = 0.0.0.0:11891
1198
1199 [input.kubernetes_events]
1200
1201 disabled = false
1202
1203 type = events
1204
1205 elasticsearch.datastream =
1206
1207 output =
1208
1209 excludeManagedFields = true
1210
1211 [input.kubernetes_watch::deployments]
1212 disabled = false
1213
1214 # How often every object is forwarded again; one no longer listed is forwarded as DELETED
1215 # with "reason":"absent_from_relist"
1216 refresh = 45m
1217
1218 apiVersion = apps/v1
1219 kind = deployment
1220 namespace =
1221
1222 type = objects
1223
1224 elasticsearch.datastream =
1225
1226 output =
1227
1228 excludeManagedFields = true
1229
1230 # you can remove or hash some values in the events (after modifyValues you can define path in the JSON object,
1231 # and the value can be hash:{hashFunction}, or remove to remove the object )
1232 ; modifyValues.object.data.* = hash:sha256
1233 ; modifyValues.object.metadata.annotations.* = remove
1234
1235 # You can exclude events by namespace with blacklist or whitelist only required namespaces
1236 # blacklist.kubernetes.namespace.name = ^namespace0$
1237 # whitelist.kubernetes.namespace.name = ^((namespace1)|(namespace2))$
1238 # A cluster-scoped kind has no namespace: filter it by a path, such as object.metadata.name
1239
1240 [input.kubernetes_watch::nodes]
1241 disabled = false
1242
1243 # How often every object is forwarded again; one no longer listed is forwarded as DELETED
1244 # with "reason":"absent_from_relist"
1245 refresh = 45m
1246
1247 apiVersion = v1
1248 kind = Node
1249 namespace =
1250
1251 type = objects
1252
1253 elasticsearch.datastream =
1254
1255 output =
1256
1257 excludeManagedFields = true
1258
1259 # you can remove or hash some values in the events (after modifyValues you can define path in the JSON object,
1260 # and the value can be hash:{hashFunction}, or remove to remove the object )
1261 ; modifyValues.object.data.* = hash:sha256
1262 ; modifyValues.object.metadata.annotations.* = remove
1263
1264 # You can exclude events by namespace with blacklist or whitelist only required namespaces
1265 # blacklist.kubernetes.namespace.name = ^namespace0$
1266 # whitelist.kubernetes.namespace.name = ^((namespace1)|(namespace2))$
1267 # A cluster-scoped kind has no namespace: filter it by a path, such as object.metadata.name
1268
1269 [input.kubernetes_watch::pods]
1270 disabled = false
1271
1272 # How often every object is forwarded again; one no longer listed is forwarded as DELETED
1273 # with "reason":"absent_from_relist"
1274 refresh = 45m
1275
1276 apiVersion = v1
1277 kind = Pod
1278 namespace =
1279
1280 type = objects
1281
1282 elasticsearch.datastream =
1283
1284 output =
1285
1286 excludeManagedFields = true
1287
1288 # you can remove or hash some values in the events (after modifyValues you can define path in the JSON object,
1289 # and the value can be hash:{hashFunction}, or remove to remove the object )
1290 ; modifyValues.object.data.* = hash:sha256
1291 ; modifyValues.object.metadata.annotations.* = remove
1292
1293 # You can exclude events by namespace with blacklist or whitelist only required namespaces
1294 # blacklist.kubernetes.namespace.name = ^namespace0$
1295 # whitelist.kubernetes.namespace.name = ^((namespace1)|(namespace2))$
1296 # A cluster-scoped kind has no namespace: filter it by a path, such as object.metadata.name
1297
1298 [input.kubernetes_watch::resourcequota]
1299 disabled = false
1300
1301 # How often every object is forwarded again; one no longer listed is forwarded as DELETED
1302 # with "reason":"absent_from_relist"
1303 refresh = 45m
1304
1305 apiVersion = v1
1306 kind = ResourceQuota
1307 namespace =
1308
1309 type = objects
1310
1311 elasticsearch.datastream =
1312
1313 output =
1314
1315 excludeManagedFields = true
1316
1317 # you can remove or hash some values in the events (after modifyValues you can define path in the JSON object,
1318 # and the value can be hash:{hashFunction}, or remove to remove the object )
1319 ; modifyValues.object.data.* = hash:sha256
1320 ; modifyValues.object.metadata.annotations.* = remove
1321
1322 # You can exclude events by namespace with blacklist or whitelist only required namespaces
1323 # blacklist.kubernetes.namespace.name = ^namespace0$
1324 # whitelist.kubernetes.namespace.name = ^((namespace1)|(namespace2))$
1325 # A cluster-scoped kind has no namespace: filter it by a path, such as object.metadata.name1326 es-default-index-lifecycle-management-policy.json: |
1327 {
1328 "policy": {
1329 "_meta": {
1330 "description": "Default policy for Collectord indexes",
1331 "version": 1
1332 },
1333 "phases": {
1334 "hot": {
1335 "min_age": "0ms",
1336 "actions": {
1337 "rollover": {
1338 "max_primary_shard_size": "50gb",
1339 "max_age": "30d"
1340 }
1341 }
1342 }
1343 }
1344 }
1345 }
1346
1347 es-default-index-template.json: |
1348 {
1349 "version": 1,
1350 "data_stream": {},
1351 "_meta": {
1352 "description": "Default template for Collectord indexes"
1353 },
1354 "priority": 500,
1355 "template": {
1356 "settings": {
1357 "index": {
1358 "lifecycle": {
1359 "name": "logs-collectord"
1360 },
1361 "refresh_interval": "5s",
1362 "mapping": {
1363 "total_fields": {
1364 "limit": "10000"
1365 }
1366 },
1367 "max_docvalue_fields_search": "200"
1368 },
1369 "query": {
1370 "default_field": [
1371 "message",
1372 "container.name",
1373 "container.image.name",
1374 "host.name",
1375 "orchestrator.namespace",
1376 "orchestrator.cluster.name",
1377 "container.name",
1378 "kubernetes.pod.name",
1379 "kubernetes.pod.id",
1380 "kubernetes.pod.ip",
1381 "kubernetes.namespace.name",
1382 "kubernetes.node.name",
1383 "kubernetes.cluster.name",
1384 "kubernetes.replicaset.name",
1385 "kubernetes.deployment.name",
1386 "kubernetes.statefulset.name",
1387 "kubernetes.daemonset.name",
1388 "kubernetes.job.name",
1389 "kubernetes.cronjob.name"
1390 ]
1391 }
1392 },
1393 "mappings": {
1394 "dynamic_templates": [
1395 {
1396 "kubernetes.pod.labels.*": {
1397 "path_match": "kubernetes.pod.labels.*",
1398 "mapping": { "type": "keyword" },
1399 "match_mapping_type": "*"
1400 }
1401 },
1402 {
1403 "kubernetes.namespace.labels.*": {
1404 "path_match": "kubernetes.namespace.labels.*",
1405 "mapping": { "type": "keyword" },
1406 "match_mapping_type": "*"
1407 }
1408 },
1409 {
1410 "kubernetes.node.labels.*": {
1411 "path_match": "kubernetes.node.labels.*",
1412 "mapping": { "type": "keyword" },
1413 "match_mapping_type": "*"
1414 }
1415 },
1416 {
1417 "kubernetes.daemonset.labels.*": {
1418 "path_match": "kubernetes.daemonset.labels.*",
1419 "mapping": { "type": "keyword" },
1420 "match_mapping_type": "*"
1421 }
1422 },
1423 {
1424 "kubernetes.replicaset.labels.*": {
1425 "path_match": "kubernetes.replicaset.labels.*",
1426 "mapping": { "type": "keyword" },
1427 "match_mapping_type": "*"
1428 }
1429 },
1430 {
1431 "kubernetes.deployment.labels.*": {
1432 "path_match": "kubernetes.deployment.labels.*",
1433 "mapping": { "type": "keyword" },
1434 "match_mapping_type": "*"
1435 }
1436 },
1437 {
1438 "kubernetes.statefulset.labels.*": {
1439 "path_match": "kubernetes.statefulset.labels.*",
1440 "mapping": { "type": "keyword" },
1441 "match_mapping_type": "*"
1442 }
1443 },
1444 {
1445 "kubernetes.job.labels.*": {
1446 "path_match": "kubernetes.job.labels.*",
1447 "mapping": { "type": "keyword" },
1448 "match_mapping_type": "*"
1449 }
1450 },
1451 {
1452 "kubernetes.cronjob.labels.*": {
1453 "path_match": "kubernetes.cronjob.labels.*",
1454 "mapping": { "type": "keyword" },
1455 "match_mapping_type": "*"
1456 }
1457 },
1458 {
1459 "strings_as_keyword": {
1460 "mapping": { "ignore_above": 1024, "type": "keyword" },
1461 "match_mapping_type": "string"
1462 }
1463 }
1464 ],
1465 "properties": {
1466 "@timestamp": { "type": "date"},
1467 "message":{"type":"match_only_text"},
1468 "collectord_errors": {"type": "keyword","ignore_above": 1024},
1469 "collectord_repeat_count": {"type": "long"},
1470 "collectord_repeat_span": {"type": "long"},
1471 "collectord_repeat_offsets": {"type": "long"},
1472 "collectord_fold_count": {"type": "long"},
1473 "collectord_fold_bytes": {"type": "long"},
1474 "collectord_pattern_lines": {"type": "long"},
1475 "collectord_pattern_bytes": {"type": "long"},
1476 "collectord_pattern_seconds": {"type": "long"},
1477 "collectord": {"properties": {
1478 "repeat": {"properties": {
1479 "count": {"type": "long"},
1480 "span": {"type": "long"},
1481 "offsets": {"type": "long"}
1482 }},
1483 "fold": {"properties": {
1484 "count": {"type": "long"},
1485 "bytes": {"type": "long"}
1486 }},
1487 "pattern": {"properties": {
1488 "lines": {"type": "long"},
1489 "bytes": {"type": "long"},
1490 "seconds": {"type": "long"}
1491 }}
1492 }},
1493 "input":{"properties":{"type":{"ignore_above":1024,"type":"keyword"}}},
1494 "container": {"properties": {
1495 "name": { "ignore_above": 1024, "type": "keyword"},
1496 "id": { "ignore_above": 1024, "type": "keyword"},
1497 "runtime": {"ignore_above": 1024, "type": "keyword"},
1498 "image": {"properties": {
1499 "name": { "ignore_above": 1024, "type": "keyword"}
1500 }}
1501 }
1502 },
1503 "event": {"properties": {
1504 "id": {"ignore_above": 1024, "type": "keyword"}
1505 }},
1506 "host": {"properties": {
1507 "name": {"ignore_above": 1024, "type": "keyword"},
1508 "architecture": {"ignore_above": 1024, "type": "keyword"},
1509 "hostname": {"ignore_above": 1024, "type": "keyword"}
1510 }},
1511 "log": { "properties": {
1512 "file": { "properties": {
1513 "path": {"ignore_above": 1024, "type": "keyword"}
1514 }},
1515 "offset": {"type": "long"},
1516 "syslog": {"properties": {
1517 "appname": {"ignore_above": 1024, "type": "keyword"},
1518 "facility": {"properties": {
1519 "code": {"type": "long"}
1520 }},
1521 "priority": {"type": "long"},
1522 "procid": {"type": "long"},
1523 "hostname": {"ignore_above": 1024, "type": "keyword"}
1524 }}
1525 }},
1526 "orchestrator": {"properties": {
1527 "cluster": {"properties": {
1528 "name": {"ignore_above": 1024, "type": "keyword"}
1529 }},
1530 "namespace": {"properties": {
1531 "name":{"path":"kubernetes.namespace.name","type":"alias"}
1532 }},
1533 "type": {"ignore_above": 1024, "type": "keyword"}
1534 }},
1535 "stream": {"ignore_above": 1024, "type": "keyword"},
1536 "agent":{"properties":{
1537 "hostname":{"path":"agent.name","type":"alias"},
1538 "name":{"ignore_above":1024,"type":"keyword"},
1539 "id":{"ignore_above":1024,"type":"keyword"},
1540 "type":{"ignore_above":1024,"type":"keyword"},
1541 "ephemeral_id":{"ignore_above":1024,"type":"keyword"},
1542 "version":{"ignore_above":1024,"type":"keyword"}
1543 }},
1544 "ecs":{"properties":{"version":{"ignore_above":1024,"type":"keyword"}}},
1545 "kubernetes": { "properties": {
1546 "container": {"properties": {
1547 "imageid": {"ignore_above": 1024, "type": "keyword"}
1548 }},
1549 "host": {"properties": {
1550 "ip": {"type": "ip"}
1551 }},
1552 "namespace": {"properties": {
1553 "name": {"ignore_above": 1024, "type": "keyword"}
1554 }},
1555 "node": { "properties": {
1556 "id": {"ignore_above": 1024, "type": "keyword"},
1557 "name": {"ignore_above": 1024,"type": "keyword"}
1558 }},
1559 "pod": {"properties": {
1560 "id": {"ignore_above": 1024,"type": "keyword"},
1561 "ip": {"type": "ip"},
1562 "name": {"ignore_above": 1024,"type": "keyword"}
1563 }},
1564 "statefulset": { "properties": {
1565 "id": {"ignore_above": 1024,"type": "keyword"},
1566 "name": {"ignore_above": 1024,"type": "keyword"}
1567 }},
1568 "replicaset": {"properties": {
1569 "id": {"ignore_above": 1024,"type": "keyword"},
1570 "name": {"ignore_above": 1024, "type": "keyword"}
1571 }},
1572 "deployment": { "properties": {
1573 "id": {"ignore_above": 1024,"type": "keyword"},
1574 "name": {"ignore_above": 1024,"type": "keyword" }
1575 }},
1576 "cronjob": {"properties": {
1577 "id": {"ignore_above": 1024,"type": "keyword"},
1578 "name": {"ignore_above": 1024, "type": "keyword"}
1579 }},
1580 "job": {"properties": {
1581 "id": {"ignore_above": 1024,"type": "keyword"},
1582 "name": {"ignore_above": 1024, "type": "keyword"}
1583 }}
1584 }},
1585 "volume": {"properties": {
1586 "name": {"ignore_above": 1024,"type": "keyword"}
1587 }}
1588 }
1589 }
1590 },
1591 "index_patterns": ["logs-collectord-${COLLECTORD_VERSION}"]
1592 }
1593
1594 es-failed-index-template.json: |
1595 {
1596 "version": 1,
1597 "data_stream": {},
1598 "_meta": {
1599 "description": "Default template for Collectord indexes for events that failed to be ingested"
1600 },
1601 "priority": 1000,
1602 "template": {
1603 "settings": {
1604 "index": {
1605 "lifecycle": {
1606 "name": "logs-collectord"
1607 },
1608 "refresh_interval": "5s",
1609 "mapping": {
1610 "total_fields": {
1611 "limit": "10000"
1612 }
1613 },
1614 "max_docvalue_fields_search": "200"
1615 },
1616 "query": {
1617 "default_field": [
1618 "message"
1619 ]
1620 }
1621 },
1622 "mappings": {
1623 "properties": {
1624 "@timestamp": {
1625 "type": "date"},
1626 "message": {
1627 "type": "match_only_text"}
1628 }
1629 }
1630 },
1631 "index_patterns": [
1632 "logs-collectord-failed-${COLLECTORD_VERSION}"]
1633 }
1634---
1635apiVersion: apps/v1
1636kind: DaemonSet
1637metadata:
1638 name: collectorforkubernetes-elasticsearch
1639 namespace: collectorforkubernetes
1640 annotations:
1641 collectord.collectord.io/logs-replace.ignoredebuglog-search: ^(TRACE|DEBUG) .*
1642 collectord.collectord.io/logs-replace.ignoredebuglog-val: ""
1643 labels:
1644 app: collectorforkubernetes-elasticsearch
1645spec:
1646 updateStrategy:
1647 type: RollingUpdate
1648 selector:
1649 matchLabels:
1650 daemon: collectorforkubernetes-elasticsearch
1651 template:
1652 metadata:
1653 name: collectorforkubernetes-elasticsearch
1654 annotations:
1655 # A change to the configuration files these pods mount rolls them:
1656 # Collectord reads its inputs' configuration at startup. A ConfigMap managed
1657 # outside the chart (configMap.create: false) gets no checksum: roll the pods
1658 # with an annotation of your own under podAnnotations.
1659 checksum/config: bfbdfd8d4d70aa570006a0f97adc4ee277e73636c2c32e48e56069701dd3a4d9
1660 labels:
1661 daemon: collectorforkubernetes-elasticsearch
1662 spec:
1663 priorityClassName: "system-node-critical"
1664 dnsPolicy: ClusterFirstWithHostNet
1665 hostNetwork: true
1666 serviceAccountName: collectorforkubernetes
1667 nodeSelector:
1668 kubernetes.io/os: linux
1669 affinity:
1670 nodeAffinity:
1671 requiredDuringSchedulingIgnoredDuringExecution:
1672 nodeSelectorTerms:
1673 - matchExpressions:
1674 - key: eks.amazonaws.com/compute-type
1675 operator: NotIn
1676 values:
1677 - fargate
1678 - key: type
1679 operator: NotIn
1680 values:
1681 - virtual-kubelet
1682 tolerations:
1683 - effect: NoSchedule
1684 operator: Exists
1685 - effect: NoExecute
1686 operator: Exists
1687 containers:
1688 - name: collectorforkubernetes
1689 image: registry.outcold.solutions/outcoldsolutions/collectorforkubernetes:26.10.1
1690 imagePullPolicy: Always
1691 livenessProbe:
1692 failureThreshold: 3
1693 httpGet:
1694 host: 127.0.0.1
1695 path: /healthz
1696 port: 11891
1697 initialDelaySeconds: 120
1698 periodSeconds: 60
1699 timeoutSeconds: 5
1700 readinessProbe:
1701 failureThreshold: 3
1702 httpGet:
1703 host: 127.0.0.1
1704 path: /readyz
1705 port: 11891
1706 initialDelaySeconds: 10
1707 periodSeconds: 15
1708 timeoutSeconds: 5
1709 securityContext:
1710 runAsUser: 0
1711 privileged: true
1712 resources:
1713 limits:
1714 cpu: 2000m
1715 memory: 1024Mi
1716 requests:
1717 cpu: 500m
1718 memory: 256Mi
1719 env:
1720 - name: KUBERNETES_NODENAME
1721 valueFrom:
1722 fieldRef:
1723 fieldPath: spec.nodeName
1724 - name: KUBERNETES_NODEIP
1725 valueFrom:
1726 fieldRef:
1727 fieldPath: status.hostIP
1728 - name: POD_NAME
1729 valueFrom:
1730 fieldRef:
1731 fieldPath: metadata.name
1732 volumeMounts:
1733 - name: collectorforkubernetes-state
1734 mountPath: /data
1735 - name: collectorforkubernetes-config
1736 mountPath: /config/
1737 readOnly: true
1738 - name: rootfs
1739 mountPath: /rootfs/
1740 readOnly: false
1741 mountPropagation: HostToContainer
1742 - name: localtime
1743 mountPath: /etc/localtime
1744 readOnly: true
1745
1746 volumes:
1747 - name: collectorforkubernetes-state
1748 hostPath:
1749 path: /var/lib/collectorforkubernetes-elasticsearch/data/
1750 type: DirectoryOrCreate
1751 - name: rootfs
1752 hostPath:
1753 path: /
1754 - name: localtime
1755 hostPath:
1756 path: /etc/localtime
1757 - name: collectorforkubernetes-config
1758 configMap:
1759 name: collectorforkubernetes-elasticsearch
1760 items:
1761 - key: 001-general.conf
1762 path: 001-general.conf
1763 - key: 002-daemonset.conf
1764 path: 002-daemonset.conf
1765 - key: es-default-index-lifecycle-management-policy.json
1766 path: es-default-index-lifecycle-management-policy.json
1767 - key: es-default-index-template.json
1768 path: es-default-index-template.json
1769 - key: es-failed-index-template.json
1770 path: es-failed-index-template.json
1771---
1772apiVersion: apps/v1
1773kind: Deployment
1774metadata:
1775 name: collectorforkubernetes-elasticsearch-addon
1776 namespace: collectorforkubernetes
1777 annotations:
1778 collectord.collectord.io/logs-replace.ignoredebuglog-search: ^(TRACE|DEBUG) .*
1779 collectord.collectord.io/logs-replace.ignoredebuglog-val: ""
1780 labels:
1781 app: collectorforkubernetes-elasticsearch
1782spec:
1783 replicas: 1
1784 selector:
1785 matchLabels:
1786 daemon: collectorforkubernetes-elasticsearch
1787 template:
1788 metadata:
1789 name: collectorforkubernetes-elasticsearch-addon
1790 annotations:
1791 # A change to the configuration files these pods mount rolls them:
1792 # Collectord reads its inputs' configuration at startup. A ConfigMap managed
1793 # outside the chart (configMap.create: false) gets no checksum: roll the pods
1794 # with an annotation of your own under podAnnotations.
1795 checksum/config: edadbcd18a068a4c08657ed518a4c7db50d98590b707deb97d3309e1a6c110f8
1796 labels:
1797 daemon: collectorforkubernetes-elasticsearch
1798 spec:
1799 priorityClassName: "system-cluster-critical"
1800 serviceAccountName: collectorforkubernetes
1801 nodeSelector:
1802 kubernetes.io/os: linux
1803 affinity:
1804 nodeAffinity:
1805 requiredDuringSchedulingIgnoredDuringExecution:
1806 nodeSelectorTerms:
1807 - matchExpressions:
1808 - key: eks.amazonaws.com/compute-type
1809 operator: NotIn
1810 values:
1811 - fargate
1812 - key: type
1813 operator: NotIn
1814 values:
1815 - virtual-kubelet
1816 containers:
1817 - name: collectorforkubernetes
1818 image: registry.outcold.solutions/outcoldsolutions/collectorforkubernetes:26.10.1
1819 imagePullPolicy: Always
1820 livenessProbe:
1821 failureThreshold: 3
1822 httpGet:
1823 path: /healthz
1824 port: 11891
1825 initialDelaySeconds: 120
1826 periodSeconds: 60
1827 timeoutSeconds: 5
1828 readinessProbe:
1829 failureThreshold: 3
1830 httpGet:
1831 path: /readyz
1832 port: 11891
1833 initialDelaySeconds: 10
1834 periodSeconds: 15
1835 timeoutSeconds: 5
1836 securityContext:
1837 allowPrivilegeEscalation: false
1838 capabilities:
1839 drop:
1840 - ALL
1841 privileged: false
1842 runAsUser: 0
1843 seLinuxOptions:
1844 type: spc_t
1845 seccompProfile:
1846 type: RuntimeDefault
1847 resources:
1848 limits:
1849 cpu: 1000m
1850 memory: 512Mi
1851 requests:
1852 cpu: 200m
1853 memory: 64Mi
1854 env:
1855 - name: KUBERNETES_NODENAME
1856 valueFrom:
1857 fieldRef:
1858 fieldPath: spec.nodeName
1859 - name: POD_NAME
1860 valueFrom:
1861 fieldRef:
1862 fieldPath: metadata.name
1863 volumeMounts:
1864 - name: collectorforkubernetes-state
1865 mountPath: /data
1866 - name: collectorforkubernetes-config
1867 mountPath: /config/
1868 readOnly: true
1869 - name: localtime
1870 mountPath: /etc/localtime
1871 readOnly: true
1872
1873 volumes:
1874 # The DaemonSet pod on this node owns the directory and the database the
1875 # addon opens read-only. DirectoryOrCreate, so an addon scheduled first
1876 # mounts it too; Collectord waits for the DaemonSet to create the database.
1877 - name: collectorforkubernetes-state
1878 hostPath:
1879 path: /var/lib/collectorforkubernetes-elasticsearch/data/
1880 type: DirectoryOrCreate
1881 - name: localtime
1882 hostPath:
1883 path: /etc/localtime
1884 - name: collectorforkubernetes-config
1885 configMap:
1886 name: collectorforkubernetes-elasticsearch
1887 items:
1888 - key: 001-general.conf
1889 path: 001-general.conf
1890 - key: 004-addon.conf
1891 path: 004-addon.conf
1892 - key: es-default-index-lifecycle-management-policy.json
1893 path: es-default-index-lifecycle-management-policy.json
1894 - key: es-default-index-template.json
1895 path: es-default-index-template.json
1896 - key: es-failed-index-template.json
1897 path: es-failed-index-template.json