Download
Link
collectorforkubernetes-opensearch.yaml
CURL
1curl -O https://www.outcoldsolutions.com/docs/elasticsearch-kubernetes/collectorforkubernetes-opensearch.yamlWGET
1wget https://www.outcoldsolutions.com/docs/elasticsearch-kubernetes/collectorforkubernetes-opensearch.yamlcollectorforkubernetes.yaml
1apiVersion: v1
2kind: Namespace
3metadata:
4 labels:
5 app: collectorforkubernetes
6 name: collectorforkubernetes
7---
8apiVersion: apiextensions.k8s.io/v1
9kind: CustomResourceDefinition
10metadata:
11 name: configurations.collectord.io
12spec:
13 group: collectord.io
14 versions:
15 - name: v1
16 served: true
17 storage: true
18 schema:
19 openAPIV3Schema:
20 type: object
21 properties:
22 spec:
23 type: object
24 additionalProperties: true
25 force:
26 type: boolean
27 scope: Cluster
28 names:
29 plural: configurations
30 singular: configuration
31 kind: Configuration
32
33---
34apiVersion: v1
35kind: ServiceAccount
36metadata:
37 labels:
38 app: collectorforkubernetes
39 name: collectorforkubernetes
40 namespace: collectorforkubernetes
41---
42apiVersion: scheduling.k8s.io/v1
43kind: PriorityClass
44metadata:
45 name: collectorforkubernetes-critical
46value: 1000000000
47---
48apiVersion: rbac.authorization.k8s.io/v1
49kind: ClusterRole
50metadata:
51 labels:
52 app: collectorforkubernetes
53 name: collectorforkubernetes
54rules:
55- apiGroups: ['extensions']
56 resources: ['podsecuritypolicies']
57 verbs: ['use']
58 resourceNames:
59 - privileged
60- apiGroups:
61 - ""
62 - apps
63 - batch
64 - extensions
65 - rbac.authorization.k8s.io
66 - collectord.io
67 resources:
68 - alertmanagers
69 - cronjobs
70 - daemonsets
71 - deployments
72 - endpoints
73 - events
74 - jobs
75 - namespaces
76 - nodes
77 - nodes/metrics
78 - nodes/proxy
79 - pods
80 - replicasets
81 - replicationcontrollers
82 - scheduledjobs
83 - services
84 - statefulsets
85 - persistentvolumeclaims
86 - configurations
87 - resourcequotas
88 - clusterroles
89 - secrets
90 - configmaps
91 verbs:
92 - get
93 - list
94 - watch
95- nonResourceURLs:
96 - /metrics
97 verbs:
98 - get
99 apiGroups: []
100 resources: []
101---
102apiVersion: rbac.authorization.k8s.io/v1
103kind: ClusterRoleBinding
104metadata:
105 labels:
106 app: collectorforkubernetes
107 name: collectorforkubernetes
108 namespace: collectorforkubernetes
109roleRef:
110 apiGroup: rbac.authorization.k8s.io
111 kind: ClusterRole
112 name: collectorforkubernetes
113subjects:
114 - kind: ServiceAccount
115 name: collectorforkubernetes
116 namespace: collectorforkubernetes
117---
118apiVersion: v1
119kind: ConfigMap
120metadata:
121 name: collectorforkubernetes-elasticsearch
122 namespace: collectorforkubernetes
123 labels:
124 app: collectorforkubernetes-elasticsearch
125data:
126 001-general.conf: |
127 # The general configuration is used for all deployments
128 #
129 # Run collectord with the flag -conf and specify location of the configuration files.
130 #
131 # You can override all the values using environment variables with the format like
132 # COLLECTOR__<ANYNAME>=<section>__<key>=<value>
133 # As an example you can set dataPath in [general] section as
134 # COLLECTOR__DATAPATH=general__dataPath=C:\\some\\path\\data.db
135 # This parameter can be configured using -env-override, set it to empty string to disable this feature
136
137 [general]
138 # Please review license https://www.outcoldsolutions.com/legal/license-agreement/
139 # and accept license by changing the value to *true*
140 acceptLicense = false
141
142 # Location for the database
143 # Collectord stores positions of the files and internal state
144 dataPath = ./data/
145
146 # log level (accepted values are trace, debug, info, warn, error, fatal)
147 logLevel = info
148
149 # http server gives access to two endpoints
150 # /healthz
151 # /metrics/json
152 # /metrics/prometheus
153 httpServerBinding =
154
155 # telemetry report endpoint, set it to empty string to disable telemetry
156 telemetryEndpoint = https://license.outcold.solutions/telemetry/
157
158 # license check endpoint
159 licenseEndpoint = https://license.outcold.solutions/license/
160
161 # license server through proxy
162 licenseServerProxyUrl =
163
164 # authentication with basic authorization (user:password)
165 licenseServerProxyBasicAuth =
166
167 # license key
168 license =
169
170 # Environment variable $KUBERNETES_NODENAME is used by default to setup hostname
171 # Use value below to override specific name
172 # hostname = ${KUBERNETES_NODENAME}.second
173
174 # Default output for events, logs and metrics
175 # valid values: elasticsearch and devnull
176 # Use devnull by default if you don't want to redirect data
177 defaultOutput = elasticsearch
178
179 # Buffer size for file reads. 8k matches the common filesystem block size and
180 # cuts the number of read syscalls substantially versus the historical 256b.
181 fileInputBufferSize = 8k
182
183 # Maximum size of one line the file reader can read
184 fileInputLineMaxSize = 1mb
185
186 # Include custom fields to attach to every event, in example below every event sent to elasticsearch will have
187 # indexed field my_environment=dev. Fields names should match to ^[a-z][_a-z0-9\.]*$
188 # Better way to configure that is to specify labels for Kubernetes Nodes.
189 # ; fields.my_environment = dev
190 # Identify the cluster if you are planning to monitor multiple clusters
191 # For ElasticSearch look at the ECS (Elastic Common Schema) documentation https://www.elastic.co/guide/en/ecs/current/ecs-field-reference.html
192 fields.ecs.version = 8.0.0
193
194 fields.orchestrator.cluster.name = -
195 fields.orchestrator.type = kubernetes
196
197 fields.agent.type = collectord
198 fields.agent.version = ${COLLECTORD_VERSION}
199 fields.agent.ephemeral_id = ${COLLECTORD_INSTANCE_RUNTIME_ID}
200 fields.agent.id = ${COLLECTORD_INSTANCE_ID}
201 fields.agent.name = ${KUBERNETES_NODENAME}
202
203 fields.host.name = ${KUBERNETES_NODENAME}
204 fields.host.hostname = ${KUBERNETES_NODENAME}
205 fields.host.architecture = ${COLLECTORD_ARCH}
206
207 # Include EC2 Metadata (see list of possible fields https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html)
208 # Should be in format ec2Metadata.{desired_field_name} = {url path to read the value}
209 # ec2Metadata.cloud.instance.id = /latest/meta-data/instance-id
210 # ec2Metadata.cloud.machine.type = /latest/meta-data/instance-type
211
212 # subdomain for the annotations added to the pods, workloads, namespaces or containers, like elasticsearch.collectord.io/..
213 annotationsSubdomain = elasticsearch
214
215 # configure global thruput per second for forwarded logs (metrics are not included)
216 # for example if you set `thruputPerSecond = 512Kb`, that will limit amount of logs forwarded
217 # from the single Collectord instance to 512Kb per second.
218 # You can configure thruput individually for the logs (including specific for container logs) below
219 thruputPerSecond =
220 ; thruputPerSecond = 512Kb
221
222 # Configure events that are too old to be forwarded, for example 168h (7 days) - that will drop all events
223 # older than 7 days
224 tooOldEvents =
225
226 # Configure events that are too new to be forwarded, for example 1h - that will drop all events that are 1h in future
227 tooNewEvents =
228
229 # Multi-output async publishing. When enabled (default), events routed to
230 # non-default outputs are published asynchronously so that a slow or down
231 # output does not block events destined for other outputs.
232 ; multioutput.async = true
233 # Buffer size for the async proxy (default 100). Absorbs transient bursts.
234 # When this buffer and the output's own queue are both full, events are
235 # dropped immediately without blocking the pipeline.
236 ; multioutput.asyncBufferSize = 100
237
238 [license.client]
239 # point to the license located on the HTTP web server, or a hosted by the Collectord running as license server
240 url =
241 # basic authentication for the HTTP server
242 basicAuth =
243 # if SSL, ignore the certificate verification
244 insecure = false
245 # CA Path for the Server certificate
246 capath =
247 # CA Name fot the Server certificate
248 caname =
249 # license server through proxy
250 proxyUrl =
251 # authentication with basic authorization (user:password)
252 proxyBasicAuth =
253
254 # connection to kubernetes api
255 [general.kubernetes]
256
257 # Override service URL for Kubernetes (default is ${KUBERNETES_SERVICE_HOST}:${KUBERNETES_SERVICE_PORT})
258 serviceURL =
259
260 # Environment variable $KUBERNETES_NODENAME is used by default to setup nodeName
261 # Use it only when you need to override it
262 nodeName =
263
264 # Configuration to access the API server,
265 # see https://kubernetes.io/docs/tasks/access-application-cluster/access-cluster/#accessing-the-api-from-a-pod
266 # for details
267 tokenPath = /var/run/secrets/kubernetes.io/serviceaccount/token
268 certPath = /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
269
270 # Default timeout for http responses. The streaming/watch requests depend on this timeout.
271 timeout = 30m
272
273 # How long to keep the cache for the recent calls to API server (to limit number of calls when collectord discovers new pods)
274 metadataTTL = 30s
275
276 # path to the kubelet root location (use it to discover application logs for emptyDir)
277 # the expected format is `pods/{pod-id}/volumes/kubernetes.io~empty-dir/{volume-name}/_data/`
278 volumesRootDir = /rootfs/var/lib/kubelet/
279
280 # You can attach annotations as a metadata, using the format
281 # includeAnnotations.{key} = {regexp}
282 # For example if you want to include all annotations that starts with `prometheus.io` or `example.com` you can include
283 # the following format:
284 # includeAnnotations.1 = ^prometheus\.io.*
285 # includeAnnotations.2 = ^example\.com.*
286
287 # watch for changes (annotations) in the objects
288 watch.namespaces = v1/namespace
289 watch.deployments = apps/v1/deployment
290 watch.configurations = collectord.io/v1/configuration
291
292 # Collectord can review the assigned ClusterRole and traverse metadata for the Pods only for the Owner objects
293 # that are defined in the ClusterRole, ignoring anything else, it does not have access to.
294 # This way Collectord does not generate 403 requests on API Server
295 clusterRole = collectorforkubernetes
296
297 # Alternative of telling Collectord about the ClusterRole is to manually list the objects.
298 # You can define which objects Collectord should traverse when it sees Owners.
299 ; traverseOwnership.namespaces = v1/namespace
300
301
302 # ElasticSearch output
303 [output.elasticsearch]
304
305 # Default data stream name
306 dataStream = logs-collectord-{{agent.version}}
307 dataStreamFailedEvents = logs-collectord-failed-{{agent.version}}
308
309 # ElasticSearch Scheme Host and Port
310 host =
311
312 # You can specify muiltiple hosts with
313 #
314 # hosts.0 = https://es0:9200
315 # hosts.1 = https://es1:9200
316 # hosts.2 = https://es2:9200
317
318 # Specify how Hosts should be picked up (in case if multiple is used)
319 # * random - choose random url on first selection and after each failure (connection or HTTP status code >= 500)
320 # * round-robin - choose url starting from first one and bump on each failure (connection or HTTP status code >= 500)
321 # * random-with-round-robin - choose random url on first selection and after that in round-robin on each
322 # failure (connection or HTTP status code >= 500)
323 hostSelection = random-with-round-robin
324
325 # Configuration for basic authorization
326 authorizationBasicUsername =
327 authorizationBasicPassword =
328
329 # additional headers
330 headers.Content-Type = application/json
331 headers.Accept = application/json
332
333 # Allow invalid SSL server certificate
334 insecure = false
335
336 # Path to CA certificate
337 caPath =
338
339 # CA Name to verify
340 caName =
341
342 # path for client certificate (if required)
343 clientCertPath =
344
345 # path for a client key (if required)
346 clientKeyPath =
347
348 # Events are batched with the maximum size set by batchSize and staying in a pipeline for not longer
349 # than set by frequency
350 frequency = 5s
351 batchSize = 768K
352 # limit by the number of events (0 value has no limit on the number of events)
353 events = 50
354
355 # elasticsearch through proxy
356 proxyUrl =
357
358 # authentication with basic authorization (user:password)
359 proxyBasicAuth =
360
361 # Timeout specifies a time limit for requests made by collectord.
362 # The timeout includes connection time, any
363 # redirects, and reading the response body.
364 timeout = 30s
365
366 # gzip compression level (nocompression, default, 1...9)
367 compressionLevel = default
368
369 # number of dedicated elasticsearch output threads (to increase throughput above 4k events per second)
370 threads = 2
371 # Default algorithm between threads is roundrobin, but you can change it to weighted
372 threadsAlgorithm = roundrobin
373
374 # Submit objects to elasticsearch
375 #submit._ilm/policy/logs-collectord = /config/es-default-index-lifecycle-management-policy.json
376 put._index_template/logs-collectord-${COLLECTORD_VERSION} = /config/es-default-index-template.json
377 put._index_template/logs-collectord-failed-${COLLECTORD_VERSION} = /config/es-failed-index-template.json
378
379 # Dedicated queue size for the output, default is 1024, larger queue sizes will require more memory,
380 # but will allow to handle more events in case of network issues
381 queueSize = 1024
382
383 # Configure multiple outputs
384 # [output.elasticsearch::app1]
385 # host = http://esapp1:9200
386
387
388 002-daemonset.conf: |
389 # DaemonSet configuration is used for Nodes and Masters.
390
391 // connection to CRIO
392 [general.cri-o]
393
394 # url for CRIO API, only unix socket is supported
395 url = unix:///rootfs/var/run/crio/crio.sock
396
397 # Timeout for http responses to docker client. The streaming requests depend on this timeout.
398 timeout = 1m
399
400 [general.containerd]
401
402 runtimePath = /rootfs/var/run/containerd
403 namespace = k8s.io
404
405
406 # Container Log files
407 [input.files]
408
409 # disable container logs monitoring
410 disabled = false
411
412 # root location of docker log files
413 # logs are expected in standard docker format like {containerID}/{containerID}-json.log
414 # rotated files
415 path = /rootfs/var/lib/docker/containers/
416 # root location of CRI-O (including Containerd) files
417 # logs are expected in Kubernetes format, like {podID}/{containerName}/0.log
418 crioPath = /rootfs/var/log/pods/
419
420 # files are read using polling schema, when reach the EOF how often to check if files got updated
421 pollingInterval = 250ms
422
423 # how often to look for the new files under logs path
424 walkingInterval = 5s
425
426 # override type
427 type = container
428
429 # override datastream
430 elasticsearch.datastream =
431
432 # docker splits events when they are larger than 10-100k (depends on the docker version)
433 # we join them together by default and forward to elasticsearch as one event
434 joinPartialEvents = true
435
436 # In case if your containers report messages with terminal colors or other escape sequences
437 # you can enable strip for all the containers in one place.
438 # Better is to enable it only for required container with the label collectord.io/strip-terminal-escape-sequences=true
439 stripTerminalEscapeSequences = false
440 # Regexp used for stripping terminal colors, it does not stip all the escape sequences
441 # Read https://man7.org/linux/man-pages/man4/console_codes.4.html for more information
442 stripTerminalEscapeSequencesRegex = (\x1b\[\d{1,3}(;\d{1,3})*m)|(\x07)|(\x1b]\d+(\s\d)?;[^\x07]+\x07)|(.*\x1b\[K)
443
444 # sample output (-1 does not sample, 20 - only 20% of the logs should be forwarded)
445 samplingPercent = -1
446
447 # sampling key for hash based sampling (should be regexp with the named match pattern `key`)
448 samplingKey =
449
450 # set output (elasticsearch or devnull, default is [general]defaultOutput)
451 output =
452
453 # configure default thruput per second for for each container log
454 # for example if you set `thruputPerSecond = 128Kb`, that will limit amount of logs forwarded
455 # from the single container to 128Kb per second.
456 thruputPerSecond =
457
458 # Configure events that are too old to be forwarded, for example 168h (7 days) - that will drop all events
459 # older than 7 days
460 tooOldEvents =
461
462 # Configure events that are too new to be forwarded, for example 1h - that will drop all events that are 1h in future
463 tooNewEvents =
464
465 # by default every new event should start from not space symbol
466 eventPattern = ^[^\s]
467
468
469 # Application Logs
470 [input.app_logs]
471
472 # disable container application logs monitoring
473 disabled = false
474
475 # root location of mounts (applies to hostPath mounts only), if the hostPath differs inside container from the path on host
476 root = /rootfs/
477
478 # how often to review list of available volumes
479 syncInterval = 5s
480
481 # glob matching pattern for log files
482 glob = *.log*
483
484 # files are read using polling schema, when reach the EOF how often to check if files got updated
485 pollingInterval = 250ms
486
487 # how often to look for the new files under logs path
488 walkingInterval = 5s
489
490 # include verbose fields in events (file offset)
491 verboseFields = false
492
493 # override type
494 type = container.file
495
496 # override datastream
497 elasticsearch.datastream =
498
499 # we split files using new line character, with this configuration you can specify what defines the new event
500 # after new line
501 eventPatternRegex = ^[^\s]
502 # Maximum interval of messages in pipeline
503 eventPatternMaxInterval = 100ms
504 # Maximum time to wait for the messages in pipeline
505 eventPatternMaxWait = 1s
506 # Maximum message size
507 eventPatternMaxSize = 1MB
508
509 # sample output (-1 does not sample, 20 - only 20% of the logs should be forwarded)
510 samplingPercent = -1
511
512 # sampling key for hash based sampling (should be regexp with the named match pattern `key`)
513 samplingKey =
514
515 # set output (elasticsearch or devnull, default is [general]defaultOutput)
516 output =
517
518 # configure default thruput per second for for each container log
519 # for example if you set `thruputPerSecond = 128Kb`, that will limit amount of logs forwarded
520 # from the single container to 128Kb per second.
521 thruputPerSecond =
522
523 # Configure events that are too old to be forwarded, for example 168h (7 days) - that will drop all events
524 # older than 7 days
525 tooOldEvents =
526
527 # Configure events that are too new to be forwarded, for example 1h - that will drop all events that are 1h in future
528 tooNewEvents =
529
530 # Configure how long Collectord should keep the file descriptors open for files, that has not been forwarded yet
531 # When using PVC, and if pipeline is lagging behind, Collectord holding open fd for files, can cause long termination
532 # of pods, as kubelet cannot unmount the PVC volume from the system
533 maxHoldAfterClose = 1800s
534
535
536 # Host logs. Input syslog(.\d+)? files
537 [input.files::syslog]
538
539 # disable host level logs
540 disabled = false
541
542 # root location of docker files
543 path = /rootfs/var/log/
544
545 # regex matching pattern
546 match = ^(syslog|messages)(.\d+)?$
547
548 # limit search only on one level
549 recursive = false
550
551 # files are read using polling schema, when reach the EOF how often to check if files got updated
552 pollingInterval = 250ms
553
554 # how often o look for the new files under logs path
555 walkingInterval = 5s
556
557 # include verbose fields in events (file offset)
558 verboseFields = false
559
560 # override type
561 type = file
562
563 # override datastream
564 elasticsearch.datastream =
565
566 # field extraction
567 extraction = ^(?P<timestamp>[A-Za-z]+\s+\d+\s\d+:\d+:\d+)\s(?P<log__syslog__hostname>[^\s]+)\s(?P<log__syslog__appname>[^:\[]+)(\[(?P<log__syslog__procid>\d+)\])?: (.+)$
568 # extractionMessageField =
569
570 # timestamp field
571 timestampField = timestamp
572
573 # format for timestamp
574 # the layout defines the format by showing how the reference time, defined to be `Mon Jan 2 15:04:05 -0700 MST 2006`
575 timestampFormat = Jan 2 15:04:05
576
577 # Adjust date, if month/day aren't set in format
578 timestampSetMonth = false
579 timestampSetDay = false
580
581 # timestamp location (if not defined by format)
582 timestampLocation = Local
583
584 # sample output (-1 does not sample, 20 - only 20% of the logs should be forwarded)
585 samplingPercent = -1
586
587 # sampling key for hash based sampling (should be regexp with the named match pattern `key`)
588 samplingKey =
589
590 # set output (elasticsearch or devnull, default is [general]defaultOutput)
591 output =
592
593 # configure default thruput per second for this files group
594 # for example if you set `thruputPerSecond = 128Kb`, that will limit amount of logs forwarded
595 # from the files in this group to 128Kb per second.
596 thruputPerSecond =
597
598 # Configure events that are too old to be forwarded, for example 168h (7 days) - that will drop all events
599 # older than 7 days
600 tooOldEvents =
601
602 # Configure events that are too new to be forwarded, for example 1h - that will drop all events that are 1h in future
603 tooNewEvents =
604
605 # by default every new event should start from not space symbol
606 eventPattern = ^[^\s]
607
608 # Blacklisting and whitelisting the logs
609 # whitelist.0 = ^regexp$
610 # blacklist.0 = ^regexp$
611
612
613 # Host logs. Input all *.log(.\d+)? files
614 [input.files::logs]
615
616 # disable host level logs
617 disabled = false
618
619 # root location of log files
620 path = /rootfs/var/log/
621
622 # regex matching pattern
623 match = ^(([\w\-.]+\.log(.[\d\-]+)?)|(docker))$
624
625 # files are read using polling schema, when reach the EOF how often to check if files got updated
626 pollingInterval = 250ms
627
628 # how often o look for the new files under logs path
629 walkingInterval = 5s
630
631 # include verbose fields in events (file offset)
632 verboseFields = false
633
634 # override type
635 type = file
636
637 # override datastream
638 elasticsearch.datastream =
639
640 # field extraction
641 extraction =
642
643 # timestamp field
644 timestampField =
645
646 # format for timestamp
647 # the layout defines the format by showing how the reference time, defined to be `Mon Jan 2 15:04:05 -0700 MST 2006`
648 timestampFormat =
649
650 # timestamp location (if not defined by format)
651 timestampLocation =
652
653 # sample output (-1 does not sample, 20 - only 20% of the logs should be forwarded)
654 samplingPercent = -1
655
656 # sampling key for hash based sampling (should be regexp with the named match pattern `key`)
657 samplingKey =
658
659 # set output (elasticsearch or devnull, default is [general]defaultOutput)
660 output =
661
662 # configure default thruput per second for this files group
663 # for example if you set `thruputPerSecond = 128Kb`, that will limit amount of logs forwarded
664 # from the files in this group to 128Kb per second.
665 thruputPerSecond =
666
667 # Configure events that are too old to be forwarded, for example 168h (7 days) - that will drop all events
668 # older than 7 days
669 tooOldEvents =
670
671 # Configure events that are too new to be forwarded, for example 1h - that will drop all events that are 1h in future
672 tooNewEvents =
673
674 # by default every new event should start from not space symbol
675 eventPattern = ^[^\s]
676
677 # Blacklisting and whitelisting the logs
678 # whitelist.0 = ^regexp$
679 # blacklist.0 = ^regexp$
680
681
682 [input.journald]
683
684 # disable host level logs
685 disabled = false
686
687 # root location of log files
688 path.persistent = /rootfs/var/log/journal/
689 path.volatile = /rootfs/run/log/journal/
690
691 # when reach end of journald, how often to pull
692 pollingInterval = 250ms
693
694 # if you don't want to forward journald from the beginning,
695 # set the oldest event in relative value, like -14h or -30m or -30s (h/m/s supported)
696 startFromRel =
697
698 # override type
699 type = journald
700
701 # override datastream
702 elasticsearch.datastream =
703
704 # sample output (-1 does not sample, 20 - only 20% of the logs should be forwarded)
705 samplingPercent = -1
706
707 # sampling key (should be regexp with the named match pattern `key`)
708 samplingKey =
709
710 # how often to reopen the journald to free old files
711 reopenInterval = 1h
712
713 # set output (elasticsearch or devnull, default is [general]defaultOutput)
714 output =
715
716 # configure default thruput per second for journald
717 # for example if you set `thruputPerSecond = 128Kb`, that will limit amount of logs forwarded
718 # from the journald to 128Kb per second.
719 thruputPerSecond =
720
721 # Configure events that are too old to be forwarded, for example 168h (7 days) - that will drop all events
722 # older than 7 days
723 tooOldEvents =
724
725 # Configure events that are too new to be forwarded, for example 1h - that will drop all events that are 1h in future
726 tooNewEvents =
727
728 # by default every new event should start from not space symbol
729 eventPattern = ^[^\s]
730
731 # Blacklisting and whitelisting the logs
732 # whitelist.0 = ^regexp$
733 # blacklist.0 = ^regexp$
734
735 # Pipe to join events (container logs only)
736 [pipe.join]
737
738 # disable joining event
739 disabled = false
740
741 # Maximum interval of messages in pipeline
742 maxInterval = 100ms
743
744 # Maximum time to wait for the messages in pipeline
745 maxWait = 1s
746
747 # Maximum message size
748 maxSize = 1MB
749
750 # Default pattern to indicate new message (should start not from space)
751 patternRegex = ^[^\s]
752
753 # You can configure global replace rules for the events, which can help to remove sensitive data
754 # from logs before they are sent to Splunk. Those rules will be applied to all pipelines for container logs, host logs,
755 # application logs and events.
756 # In the following example we replace password=TEST with password=********
757 ; [pipe.replace::name]
758 ; patternRegex = (password=)([^\s]+)
759 ; replace = $1********
760
761 # You can configure global hash rules for the events, which can help to hide sensitive data
762 # from logs before they are sent to outputs. Those rules will be applied to all pipelines for container logs, host logs,
763 # application logs and events.
764 # In the following example we hash IP addresses with fnv-1a-64
765 ; [pipe.hash::name]
766 ; match = (\d{1,3}\.){3}\d{1,3}'
767 ; function = fnv-1a-64
768
769 004-addon.conf: |
770 [ general ]
771
772 # addons can be run in parallel with agents
773 addon = true
774
775 [input.kubernetes_events]
776
777 # disable events
778 disabled = false
779
780 # override type
781 type = events
782
783 # override datastream
784 elasticsearch.datastream =
785
786 # set output (elasticsearch or devnull, default is [general]defaultOutput)
787 output =
788
789 # exclude managed fields from the metadata
790 excludeManagedFields = true
791
792 [input.kubernetes_watch::pods]
793
794 # disable events
795 disabled = false
796
797 # Set the timeout for how often watch request should refresh the whole list
798 refresh = 10m
799
800 apiVersion = v1
801 kind = Pod
802 namespace =
803 excludeManagedFields = true
804
805 # override type
806 type = objects
807
808 # override datastream
809 elasticsearch.datastream =
810
811 # set output (elasticsearch or devnull, default is [general]defaultOutput)
812 output =
813
814 # you can remove or hash some values in the events (after modifyValues you can define path in the JSON object,
815 # and the value can be hash:{hashFunction}, or remove to remove the object )
816 ; modifyValues.object.data.* = hash:sha256
817 ; modifyValues.object.metadata.annotations.* = remove
818
819 # You can exclude events by namespace with blacklist or whitelist only required namespaces
820 # blacklist.kubernetes_namespace = ^namespace0$
821 # whitelist.kubernetes_namespace = ^((namespace1)|(namespace2))$
822
823 [input.kubernetes_watch::deployments]
824
825 # disable events
826 disabled = false
827
828 # Set the timeout for how often watch request should refresh the whole list
829 refresh = 10m
830
831 apiVersion = apps/v1
832 kind = Deployment
833 namespace =
834 excludeManagedFields = true
835
836 # override type
837 type = objects
838
839 # override datastream
840 elasticsearch.datastream =
841
842 # set output (elasticsearch or devnull, default is [general]defaultOutput)
843 output =
844
845 es-default-index-lifecycle-management-policy.json: |
846 {
847 "policy": {
848 "_meta": {
849 "description": "Default policy for Collectord indexes",
850 "version": 1
851 },
852 "phases": {
853 "hot": {
854 "min_age": "0ms",
855 "actions": {
856 "rollover": {
857 "max_primary_shard_size": "50gb",
858 "max_age": "30d"
859 }
860 }
861 }
862 }
863 }
864 }
865 es-default-index-template.json: |
866 {
867 "version": 1,
868 "data_stream": {},
869 "_meta": {
870 "description": "Default template for Collectord indexes"
871 },
872 "priority": 500,
873 "template": {
874 "settings": {
875 "index": {
876 "refresh_interval": "5s",
877 "mapping": {
878 "total_fields": {
879 "limit": "10000"
880 }
881 },
882 "max_docvalue_fields_search": "200"
883 },
884 "query": {
885 "default_field": [
886 "message",
887 "container.name",
888 "container.image.name",
889 "host.name",
890 "orchestrator.namespace",
891 "orchestrator.cluster.name",
892 "container.name",
893 "kubernetes.pod.name",
894 "kubernetes.pod.id",
895 "kubernetes.pod.ip",
896 "kubernetes.namespace.name",
897 "kubernetes.node.name",
898 "kubernetes.cluster.name",
899 "kubernetes.replicaset.name",
900 "kubernetes.deployment.name",
901 "kubernetes.statefulset.name",
902 "kubernetes.daemonset.name",
903 "kubernetes.job.name",
904 "kubernetes.cronjob.name"
905 ]
906 }
907 },
908 "mappings": {
909 "dynamic_templates": [
910 {
911 "kubernetes.pod.labels.*": {
912 "path_match": "kubernetes.pod.labels.*",
913 "mapping": { "type": "keyword" },
914 "match_mapping_type": "*"
915 }
916 },
917 {
918 "kubernetes.namespace.labels.*": {
919 "path_match": "kubernetes.namespace.labels.*",
920 "mapping": { "type": "keyword" },
921 "match_mapping_type": "*"
922 }
923 },
924 {
925 "kubernetes.node.labels.*": {
926 "path_match": "kubernetes.node.labels.*",
927 "mapping": { "type": "keyword" },
928 "match_mapping_type": "*"
929 }
930 },
931 {
932 "kubernetes.daemonset.labels.*": {
933 "path_match": "kubernetes.daemonset.labels.*",
934 "mapping": { "type": "keyword" },
935 "match_mapping_type": "*"
936 }
937 },
938 {
939 "kubernetes.replicaset.labels.*": {
940 "path_match": "kubernetes.replicaset.labels.*",
941 "mapping": { "type": "keyword" },
942 "match_mapping_type": "*"
943 }
944 },
945 {
946 "kubernetes.deployment.labels.*": {
947 "path_match": "kubernetes.deployment.labels.*",
948 "mapping": { "type": "keyword" },
949 "match_mapping_type": "*"
950 }
951 },
952 {
953 "kubernetes.statefulset.labels.*": {
954 "path_match": "kubernetes.statefulset.labels.*",
955 "mapping": { "type": "keyword" },
956 "match_mapping_type": "*"
957 }
958 },
959 {
960 "kubernetes.job.labels.*": {
961 "path_match": "kubernetes.job.labels.*",
962 "mapping": { "type": "keyword" },
963 "match_mapping_type": "*"
964 }
965 },
966 {
967 "kubernetes.cronjob.labels.*": {
968 "path_match": "kubernetes.cronjob.labels.*",
969 "mapping": { "type": "keyword" },
970 "match_mapping_type": "*"
971 }
972 },
973 {
974 "strings_as_keyword": {
975 "mapping": { "ignore_above": 1024, "type": "keyword" },
976 "match_mapping_type": "string"
977 }
978 }
979 ],
980 "properties": {
981 "@timestamp": { "type": "date"},
982 "message":{"type":"text"},
983 "collectord_errors": {"type": "keyword","ignore_above": 1024},
984 "input":{"properties":{"type":{"ignore_above":1024,"type":"keyword"}}},
985 "container": {"properties": {
986 "name": { "ignore_above": 1024, "type": "keyword"},
987 "id": { "ignore_above": 1024, "type": "keyword"},
988 "runtime": {"ignore_above": 1024, "type": "keyword"},
989 "image": {"properties": {
990 "name": { "ignore_above": 1024, "type": "keyword"}
991 }}
992 }
993 },
994 "event": {"properties": {
995 "id": {"ignore_above": 1024, "type": "keyword"}
996 }},
997 "host": {"properties": {
998 "name": {"ignore_above": 1024, "type": "keyword"},
999 "architecture": {"ignore_above": 1024, "type": "keyword"},
1000 "hostname": {"ignore_above": 1024, "type": "keyword"}
1001 }},
1002 "log": { "properties": {
1003 "file": { "properties": {
1004 "path": {"ignore_above": 1024, "type": "keyword"}
1005 }},
1006 "offset": {"type": "long"},
1007 "syslog": {"properties": {
1008 "appname": {"ignore_above": 1024, "type": "keyword"},
1009 "facility": {"properties": {
1010 "code": {"type": "long"}
1011 }},
1012 "priority": {"type": "long"},
1013 "procid": {"type": "long"},
1014 "hostname": {"ignore_above": 1024, "type": "keyword"}
1015 }}
1016 }},
1017 "orchestrator": {"properties": {
1018 "cluster": {"properties": {
1019 "name": {"ignore_above": 1024, "type": "keyword"}
1020 }},
1021 "namespace": {"properties": {
1022 "name":{"path":"kubernetes.namespace.name","type":"alias"}
1023 }},
1024 "type": {"ignore_above": 1024, "type": "keyword"}
1025 }},
1026 "stream": {"ignore_above": 1024, "type": "keyword"},
1027 "agent":{"properties":{
1028 "hostname":{"path":"agent.name","type":"alias"},
1029 "name":{"ignore_above":1024,"type":"keyword"},
1030 "id":{"ignore_above":1024,"type":"keyword"},
1031 "type":{"ignore_above":1024,"type":"keyword"},
1032 "ephemeral_id":{"ignore_above":1024,"type":"keyword"},
1033 "version":{"ignore_above":1024,"type":"keyword"}
1034 }},
1035 "ecs":{"properties":{"version":{"ignore_above":1024,"type":"keyword"}}},
1036 "kubernetes": { "properties": {
1037 "container": {"properties": {
1038 "imageid": {"ignore_above": 1024, "type": "keyword"}
1039 }},
1040 "host": {"properties": {
1041 "ip": {"type": "ip"}
1042 }},
1043 "namespace": {"properties": {
1044 "name": {"ignore_above": 1024, "type": "keyword"}
1045 }},
1046 "node": { "properties": {
1047 "id": {"ignore_above": 1024, "type": "keyword"},
1048 "name": {"ignore_above": 1024,"type": "keyword"}
1049 }},
1050 "pod": {"properties": {
1051 "id": {"ignore_above": 1024,"type": "keyword"},
1052 "ip": {"type": "ip"},
1053 "name": {"ignore_above": 1024,"type": "keyword"}
1054 }},
1055 "statefulset": { "properties": {
1056 "id": {"ignore_above": 1024,"type": "keyword"},
1057 "name": {"ignore_above": 1024,"type": "keyword"}
1058 }},
1059 "replicaset": {"properties": {
1060 "id": {"ignore_above": 1024,"type": "keyword"},
1061 "name": {"ignore_above": 1024, "type": "keyword"}
1062 }},
1063 "deployment": { "properties": {
1064 "id": {"ignore_above": 1024,"type": "keyword"},
1065 "name": {"ignore_above": 1024,"type": "keyword" }
1066 }},
1067 "cronjob": {"properties": {
1068 "id": {"ignore_above": 1024,"type": "keyword"},
1069 "name": {"ignore_above": 1024, "type": "keyword"}
1070 }},
1071 "job": {"properties": {
1072 "id": {"ignore_above": 1024,"type": "keyword"},
1073 "name": {"ignore_above": 1024, "type": "keyword"}
1074 }}
1075 }},
1076 "volume": {"properties": {
1077 "name": {"ignore_above": 1024,"type": "keyword"}
1078 }}
1079 }
1080 }
1081 },
1082 "index_patterns": ["logs-collectord-${COLLECTORD_VERSION}"]
1083 }
1084 es-failed-index-template.json: |
1085 {
1086 "version": 1,
1087 "data_stream": {},
1088 "_meta": {
1089 "description": "Default template for Collectord indexes for events that failed to be ingested"
1090 },
1091 "priority": 1000,
1092 "template": {
1093 "settings": {
1094 "index": {
1095
1096 "refresh_interval": "5s",
1097 "mapping": {
1098 "total_fields": {
1099 "limit": "10000"
1100 }
1101 },
1102 "max_docvalue_fields_search": "200"
1103 },
1104 "query": {
1105 "default_field": [
1106 "message"
1107 ]
1108 }
1109 },
1110 "mappings": {
1111 "properties": {
1112 "@timestamp": {
1113 "type": "date"},
1114 "message": {
1115 "type": "text"}
1116 }
1117 }
1118 },
1119 "index_patterns": [
1120 "logs-collectord-failed-${COLLECTORD_VERSION}"]
1121 }
1122---
1123apiVersion: apps/v1
1124kind: DaemonSet
1125metadata:
1126 name: collectorforkubernetes-elasticsearch
1127 namespace: collectorforkubernetes
1128 labels:
1129 app: collectorforkubernetes-elasticsearch
1130spec:
1131 updateStrategy:
1132 type: RollingUpdate
1133 selector:
1134 matchLabels:
1135 daemon: collectorforkubernetes-elasticsearch
1136 template:
1137 metadata:
1138 name: collectorforkubernetes-elasticsearch
1139 labels:
1140 daemon: collectorforkubernetes-elasticsearch
1141 spec:
1142 priorityClassName: collectorforkubernetes-critical
1143 dnsPolicy: ClusterFirstWithHostNet
1144 hostNetwork: true
1145 serviceAccountName: collectorforkubernetes
1146 tolerations:
1147 - operator: "Exists"
1148 effect: "NoSchedule"
1149 - operator: "Exists"
1150 effect: "NoExecute"
1151 containers:
1152 - name: collectorforkubernetes
1153 image: docker.io/outcoldsolutions/collectorforkubernetes:26.04.4
1154 imagePullPolicy: Always
1155 securityContext:
1156 runAsUser: 0
1157 privileged: true
1158 # Define your resources if you need. Defaults should be fine for most.
1159 # You can lower or increase based on your hosts.
1160 resources:
1161 limits:
1162 cpu: 2000m
1163 memory: 512Mi
1164 requests:
1165 cpu: 200m
1166 memory: 192Mi
1167 env:
1168 - name: KUBERNETES_NODENAME
1169 valueFrom:
1170 fieldRef:
1171 fieldPath: spec.nodeName
1172 - name: POD_NAME
1173 valueFrom:
1174 fieldRef:
1175 fieldPath: metadata.name
1176 volumeMounts:
1177 # We store state in /data folder (file positions)
1178 - name: collectorforkubernetes-state
1179 mountPath: /data
1180 # Configuration file deployed with ConfigMap
1181 - name: collectorforkubernetes-config
1182 mountPath: /config/
1183 readOnly: true
1184 # Rootfs
1185 - name: rootfs
1186 mountPath: /rootfs/
1187 readOnly: false
1188 mountPropagation: HostToContainer
1189 # correct timezone
1190 - name: localtime
1191 mountPath: /etc/localtime
1192 readOnly: true
1193 volumes:
1194 # We store state directly on host, change this location, if
1195 # your persistent volume is somewhere else
1196 - name: collectorforkubernetes-state
1197 hostPath:
1198 path: /var/lib/collectorforkubernetes-elasticsearch/data/
1199 type: DirectoryOrCreate
1200 # Location of docker root (for container logs and metadata)
1201 - name: rootfs
1202 hostPath:
1203 path: /
1204 # correct timezone
1205 - name: localtime
1206 hostPath:
1207 path: /etc/localtime
1208 # configuration from ConfigMap
1209 - name: collectorforkubernetes-config
1210 configMap:
1211 name: collectorforkubernetes-elasticsearch
1212 items:
1213 - key: 001-general.conf
1214 path: 001-general.conf
1215 - key: 002-daemonset.conf
1216 path: 002-daemonset.conf
1217 - key: es-default-index-template.json
1218 path: es-default-index-template.json
1219 - key: es-default-index-lifecycle-management-policy.json
1220 path: es-default-index-lifecycle-management-policy.json
1221 - key: es-failed-index-template.json
1222 path: es-failed-index-template.json
1223---
1224apiVersion: apps/v1
1225kind: Deployment
1226metadata:
1227 name: collectorforkubernetes-elasticsearch-addon
1228 namespace: collectorforkubernetes
1229 labels:
1230 app: collectorforkubernetes-elasticsearch
1231spec:
1232 replicas: 1
1233
1234 selector:
1235 matchLabels:
1236 daemon: collectorforkubernetes-elasticsearch
1237
1238 template:
1239 metadata:
1240 name: collectorforkubernetes-elasticsearch-addon
1241 labels:
1242 daemon: collectorforkubernetes-elasticsearch
1243 spec:
1244 priorityClassName: collectorforkubernetes-critical
1245 serviceAccountName: collectorforkubernetes
1246 containers:
1247 - name: collectorforkubernetes
1248 image: docker.io/outcoldsolutions/collectorforkubernetes:26.04.4
1249 imagePullPolicy: Always
1250 securityContext:
1251 runAsUser: 0
1252 privileged: true
1253 resources:
1254 limits:
1255 cpu: 500m
1256 memory: 256Mi
1257 requests:
1258 cpu: 50m
1259 memory: 64Mi
1260 env:
1261 - name: KUBERNETES_NODENAME
1262 valueFrom:
1263 fieldRef:
1264 fieldPath: spec.nodeName
1265 - name: POD_NAME
1266 valueFrom:
1267 fieldRef:
1268 fieldPath: metadata.name
1269 volumeMounts:
1270 - name: collectorforkubernetes-state
1271 mountPath: /data
1272 - name: collectorforkubernetes-config
1273 mountPath: /config/
1274 readOnly: true
1275 volumes:
1276 - name: collectorforkubernetes-state
1277 hostPath:
1278 path: /var/lib/collectorforkubernetes-elasticsearch/data/
1279 type: Directory
1280 - name: collectorforkubernetes-config
1281 configMap:
1282 name: collectorforkubernetes-elasticsearch
1283 items:
1284 - key: 001-general.conf
1285 path: 001-general.conf
1286 - key: 004-addon.conf
1287 path: 004-addon.conf
1288 - key: es-default-index-template.json
1289 path: es-default-index-template.json
1290 - key: es-default-index-lifecycle-management-policy.json
1291 path: es-default-index-lifecycle-management-policy.json
1292 - key: es-failed-index-template.json
1293 path: es-failed-index-template.json