blob: 48950ed8bbb6465b65adcde3088b900acc3c0741 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
|
elasticsearch:
enabled: true
cluster:
env:
MINIMUM_MASTER_NODES: "1"
master:
replicas: 2
client:
replicas: 1
data:
replicas: 2
kibana:
enabled: false
logstash:
enabled: false
filebeat:
enabled: true
config:
output.file.enabled: false
output.elasticsearch:
enabled: true
hosts: ["http://elastic-stack-elasticsearch-client:9200"]
filebeat.prospectors:
- type: log
enabled: true
paths:
- /var/log/*.log
- /var/log/messages
- /var/log/syslog
- type: docker
containers.ids:
- "*"
json.keys_under_root: true
json.ignore_decoding_error: true
processors:
- add_kubernetes_metadata:
- drop_event:
when:
equals:
kubernetes.container.name: "filebeat"
- decode_json_fields:
fields: ["message"]
when:
equals:
kubernetes.container.name: "modsecurity-log"
fluentd:
enabled: false
fluent-bit:
enabled: false
nginx-ldapauth-proxy:
enabled: false
elasticsearch-curator:
enabled: true
configMaps:
config_yml: |-
---
client:
hosts:
- elastic-stack-elasticsearch-client
port: 9200
action_file_yml: |-
---
actions:
1:
action: delete_indices
description: >-
Delete indices older than 30 days (based on index name), for filebeat-
prefixed indices. Ignore the error if the filter does not result in an
actionable list of indices (ignore_empty_list) and exit cleanly.
options:
ignore_empty_list: True
filters:
- filtertype: pattern
kind: prefix
value: filebeat-
- filtertype: age
source: name
direction: older
timestring: '%Y.%m.%d'
unit: days
unit_count: 30
elasticsearch-exporter:
enabled: false
|
