2 files changed, 69 insertions, 6 deletions
diff --git a/tools/eck-operator/templates/beat.yaml b/tools/eck-operator/templates/beat.yaml
new file mode 100644
index 0000000..0b9edd4
--- /dev/null
+++ b/tools/eck-operator/templates/beat.yaml
@@ -0,0 +1,40 @@
+apiVersion: beat.k8s.elastic.co/v1beta1
+kind: Beat
+metadata:
+  name: log-storage
+spec:
+  type: filebeat
+  version: 8.14.1
+  elasticsearchRef:
+    name: log-storage
+  config:
+    filebeat.inputs:
+    - type: container
+      paths:
+      - /var/log/containers/*.log
+  daemonSet:
+    podTemplate:
+      spec:
+        dnsPolicy: ClusterFirstWithHostNet
+        hostNetwork: true
+        securityContext:
+          runAsUser: 0
+        containers:
+        - name: filebeat
+          volumeMounts:
+          - name: varlogcontainers
+            mountPath: /var/log/containers
+          - name: varlogpods
+            mountPath: /var/log/pods
+          - name: varlibdockercontainers
+            mountPath: /var/lib/docker/containers
+        volumes:
+        - name: varlogcontainers
+          hostPath:
+            path: /var/log/containers
+        - name: varlogpods
+          hostPath:
+            path: /var/log/pods
+        - name: varlibdockercontainers
+          hostPath:
+            path: /var/lib/docker/containers
diff --git a/tools/eck-operator/templates/logstash.yaml b/tools/eck-operator/templates/logstash.yaml
index 13e5128..98755b9 100644
--- a/tools/eck-operator/templates/logstash.yaml
+++ b/tools/eck-operator/templates/logstash.yaml
@@ -3,11 +3,34 @@ kind: Logstash
 metadata:
   name: log-storage
 spec:
-  version: "8.14.1"
   count: 1
   elasticsearchRefs:
-  - name: log-storage
-    clusterName: default
-  config: 
-    pipeline.workers: 4
-    log.level: debug
+    - name: log-storage
+      clusterName: default
+  version: 8.14.1
+  pipelines:
+    - pipeline.id: main
+      config.string: |
+        input {
+          beats {
+            port => 5044
+          }
+        }
+        output {
+          elasticsearch {
+            hosts => [ "${QS_ES_HOSTS}" ]
+            user => "${QS_ES_USER}"
+            password => "${QS_ES_PASSWORD}"
+            ssl_certificate_authorities => "${QS_ES_SSL_CERTIFICATE_AUTHORITY}"
+          }
+        }
+  services:
+    - name: beats
+      service:
+        spec:
+          type: NodePort
+          ports:
+            - port: 5044
+              name: "filebeat"
+              protocol: TCP
+              targetPort: 5044