constellation/debugd/filebeat/templates/filebeat.yml

output.logstash:
  hosts: ["{{ .LogstashHost }}"]

output.console:
  enabled: false

logging:
  to_files: false
  metrics.enabled: false
  level: warning

filebeat.config:
  inputs:
    enabled: true
    path: /usr/share/filebeat/inputs.yml
    # reload.enabled: true
    # reload.period: 10s

timestamp.precision: nanosecond

processors:
  - dissect:
      when:
        regexp:
          log.file.path: "^/var/log/pods/*"
      tokenizer: "/var/log/pods/%{namespace}_%{pod_name}_%{uid}/%{container_name}/%{run_id}.log"
      field: "log.file.path"
      target_prefix: "kubernetes"
      ignore_failure: true