92 lines
2.0 KiB
YAML
92 lines
2.0 KiB
YAML
elasticsearch:
|
|
enabled: true
|
|
cluster:
|
|
env:
|
|
MINIMUM_MASTER_NODES: "1"
|
|
master:
|
|
replicas: 2
|
|
client:
|
|
replicas: 1
|
|
data:
|
|
replicas: 2
|
|
|
|
kibana:
|
|
enabled: false
|
|
|
|
logstash:
|
|
enabled: false
|
|
|
|
filebeat:
|
|
enabled: true
|
|
config:
|
|
output.file.enabled: false
|
|
output.elasticsearch:
|
|
enabled: true
|
|
hosts: ["http://elastic-stack-elasticsearch-client:9200"]
|
|
filebeat.prospectors:
|
|
- type: log
|
|
enabled: true
|
|
paths:
|
|
- /var/log/*.log
|
|
- /var/log/messages
|
|
- /var/log/syslog
|
|
- type: docker
|
|
containers.ids:
|
|
- "*"
|
|
json.keys_under_root: true
|
|
json.ignore_decoding_error: true
|
|
processors:
|
|
- add_kubernetes_metadata:
|
|
- drop_event:
|
|
when:
|
|
equals:
|
|
kubernetes.container.name: "filebeat"
|
|
- decode_json_fields:
|
|
fields: ["message"]
|
|
when:
|
|
equals:
|
|
kubernetes.container.name: "modsecurity-log"
|
|
|
|
fluentd:
|
|
enabled: false
|
|
|
|
fluent-bit:
|
|
enabled: false
|
|
|
|
nginx-ldapauth-proxy:
|
|
enabled: false
|
|
|
|
elasticsearch-curator:
|
|
enabled: true
|
|
configMaps:
|
|
config_yml: |-
|
|
---
|
|
client:
|
|
hosts:
|
|
- elastic-stack-elasticsearch-client
|
|
port: 9200
|
|
action_file_yml: |-
|
|
---
|
|
actions:
|
|
1:
|
|
action: delete_indices
|
|
description: >-
|
|
Delete indices older than 30 days (based on index name), for filebeat-
|
|
prefixed indices. Ignore the error if the filter does not result in an
|
|
actionable list of indices (ignore_empty_list) and exit cleanly.
|
|
options:
|
|
ignore_empty_list: True
|
|
filters:
|
|
- filtertype: pattern
|
|
kind: prefix
|
|
value: filebeat-
|
|
- filtertype: age
|
|
source: name
|
|
direction: older
|
|
timestring: '%Y.%m.%d'
|
|
unit: days
|
|
unit_count: 30
|
|
|
|
elasticsearch-exporter:
|
|
enabled: false
|