constellation/debugd/filebeat/templates/filebeat.yml

output.logstash:
  hosts: ["{{ .LogstashHost }}"]

output.console:
  enabled: false

logging:
  to_files: false
  metrics.enabled: false
  level: warning

filebeat.inputs:
  - type: journald
    enabled: true
    id: journald
  - type: filestream
    enabled: true
    id: container
    paths:
      - /var/log/pods/*/*/*.log

timestamp.precision: nanosecond

processors:
  - dissect:
      when:
        regexp:
          log.file.path: "^/var/log/pods/*"
      tokenizer: "/var/log/pods/%{namespace}_%{pod_name}_%{uid}/%{container_name}/%{run_id}.log"
      field: "log.file.path"
      target_prefix: "kubernetes"
      ignore_failure: true
  {{ if .AddCloudMetadata }}
  - add_cloud_metadata: ~
  {{ end }}