#filebeat.config:
#  modules:
#    path: ${path.config}/modules.d/*.yml
#    reload.enabled: false

filebeat.autodiscover:
  providers:
    - type: kubernetes
      node: '${NODE_NAME}'
      hints.enabled: true
      #templates:
      #  - config:
      #    - type: container
      #      paths:
      #        - /var/log/containers/*-${data.kubernetes.container.id}.log
      # kubernetes pod annotation example
      # annotations:
      #   co.elastic.logs.json-logging/json.keys_under_root: "true"
      #   co.elastic.logs.json-logging/json.add_error_key: "true"
      #   co.elastic.logs.json-logging/json.message_key: "message"
      hints.default_config:
        type: container
        paths:
          - /var/log/containers/*-${data.kubernetes.container.id}.log
        ignore_older: 24h

processors:
  - add_cloud_metadata: ~
  - add_locale:
      format: offset
  - add_kubernetes_metadata:
  - add_host_metadata: ~
  - decode_json_fields:
      fields: [ "message" ]
      target: "message_json"
      when:
        or:
          - equals:
              kubernetes.container.name: etcd
          - equals:
              kubernetes.container.name: kilo
          - equals:
              kubernetes.container.name: cfssl-issuer
  - rename:
      fields:
        - from: "kubernetes.container.name"
          to: "container.name"
      ignore_missing: true
      fail_on_error: false
  - drop_event:
      when:
        equals:
          container.name: filebeat

setup:
  kibana:
    host: '${KIBANA_HOSTS:kibana:5601}'
    ssl:
      verification_mode: none
  template:
    enabled: true
    name: "filebeat-%{[agent.version]}"
    pattern: "filebeat-%{[beat.version]}-*"
    settings:
      index.number_of_shards: 1
      index.number_of_replicas: 0
    append_fields:
      - name: container.name
        type: keyword
      - name: kubernetes.container.name
        type: keyword

  dashboards:
    enabled: false

output.elasticsearch:
  hosts: '[${ELASTICSEARCH_HOSTS:elasticsearch:9200}]'
  username: '${ELASTICSEARCH_USERNAME:}'
  password: '${ELASTICSEARCH_PASSWORD:}'
  ssl:
    verification_mode: none
  indices:
    #- index: "filebeat-%{[agent.version]}-%{[container.name]:common}-%{+yyyy.MM.dd}"
    - index: "filebeat-%{[agent.version]}-%{[container.name]:common}"


#logging.json: true
#logging.metrics.enabled: false