From f75440484508c1cc7f3ff4088c150a716dc675c2 Mon Sep 17 00:00:00 2001
From: "Ketelsen, Sven" <sven.ketelsen@netgo.de>
Date: Thu, 20 Oct 2022 10:26:49 +0000
Subject: [PATCH] DEV-629 added logging buckets for k8s [job|pod][name]

---
 .../config/logstash/pipeline/filebeat.conf.j2 | 105 +++++++++++-------
 1 file changed, 65 insertions(+), 40 deletions(-)

diff --git a/templates/logstash/config/logstash/pipeline/filebeat.conf.j2 b/templates/logstash/config/logstash/pipeline/filebeat.conf.j2
index 8194e23..2454327 100644
--- a/templates/logstash/config/logstash/pipeline/filebeat.conf.j2
+++ b/templates/logstash/config/logstash/pipeline/filebeat.conf.j2
@@ -126,7 +126,6 @@ output {
        }
     }
     else if [fields][harbor] {
-
         elasticsearch {
             hosts => ["https://{{ shared_service_elastic_stack_01_hostname }}:{{ service_port_elasticsearch }}"]
             cacert => "/usr/share/logstash/config/certificates/ca/ca.crt"
@@ -138,53 +137,79 @@ output {
             manage_template => false
        }
     }
-    else if [kubernetes][namespace] and [kubernetes][deployment][name] {
-        elasticsearch {
-            hosts => ["https://{{ shared_service_elastic_stack_01_hostname }}:{{ service_port_elasticsearch }}"]
-            cacert => "/usr/share/logstash/config/certificates/ca/ca.crt"
-            user => "{{ elastic_admin_username }}"
-            password => "{{ elastic_admin_password }}"
+    else if [kubernetes][namespace] {
+  	    if [kubernetes][deployment][name] {
+            elasticsearch {
+                hosts => ["https://{{ shared_service_elastic_stack_01_hostname }}:{{ service_port_elasticsearch }}"]
+                cacert => "/usr/share/logstash/config/certificates/ca/ca.crt"
+                user => "{{ elastic_admin_username }}"
+                password => "{{ elastic_admin_password }}"
 
-            index => "%{[stage]}-%{[kubernetes][namespace]}-%{[kubernetes][deployment][name]}-%{+YYYY.MM}"
+                index => "%{[stage]}-%{[kubernetes][namespace]}-%{[kubernetes][deployment][name]}-%{+YYYY.MM}"
 
-            manage_template => false
-       }
-    }
-    else if [kubernetes][namespace] and [kubernetes][daemonset][name] {
-        elasticsearch {
-            hosts => ["https://{{ shared_service_elastic_stack_01_hostname }}:{{ service_port_elasticsearch }}"]
-            cacert => "/usr/share/logstash/config/certificates/ca/ca.crt"
-            user => "{{ elastic_admin_username }}"
-            password => "{{ elastic_admin_password }}"
+                manage_template => false
+            }
+        }
+        else if [kubernetes][daemonset][name] {
+            elasticsearch {
+                hosts => ["https://{{ shared_service_elastic_stack_01_hostname }}:{{ service_port_elasticsearch }}"]
+                cacert => "/usr/share/logstash/config/certificates/ca/ca.crt"
+                user => "{{ elastic_admin_username }}"
+                password => "{{ elastic_admin_password }}"
 
-            index => "%{[stage]}-%{[kubernetes][namespace]}-%{[kubernetes][daemonset][name]}-%{+YYYY.MM}"
+                index => "%{[stage]}-%{[kubernetes][namespace]}-%{[kubernetes][daemonset][name]}-%{+YYYY.MM}"
 
-            manage_template => false
-       }
-    }
-    else if [kubernetes][namespace] and [kubernetes][statefulset][name] {
-        elasticsearch {
-            hosts => ["https://{{ shared_service_elastic_stack_01_hostname }}:{{ service_port_elasticsearch }}"]
-            cacert => "/usr/share/logstash/config/certificates/ca/ca.crt"
-            user => "{{ elastic_admin_username }}"
-            password => "{{ elastic_admin_password }}"
+                manage_template => false
+           }
+        }
+        else if [kubernetes][statefulset][name] {
+            elasticsearch {
+                hosts => ["https://{{ shared_service_elastic_stack_01_hostname }}:{{ service_port_elasticsearch }}"]
+                cacert => "/usr/share/logstash/config/certificates/ca/ca.crt"
+                user => "{{ elastic_admin_username }}"
+                password => "{{ elastic_admin_password }}"
 
-            index => "%{[stage]}-%{[kubernetes][namespace]}-%{[kubernetes][statefulset][name]}-%{+YYYY.MM}"
+                index => "%{[stage]}-%{[kubernetes][namespace]}-%{[kubernetes][statefulset][name]}-%{+YYYY.MM}"
 
-            manage_template => false
-       }
-    }
-    else if [kubernetes][namespace] {
-        elasticsearch {
-            hosts => ["https://{{ shared_service_elastic_stack_01_hostname }}:{{ service_port_elasticsearch }}"]
-            cacert => "/usr/share/logstash/config/certificates/ca/ca.crt"
-            user => "{{ elastic_admin_username }}"
-            password => "{{ elastic_admin_password }}"
+                manage_template => false
+           }
+        }
+        else if [kubernetes][job][name] {
+            elasticsearch {
+                hosts => ["https://{{ shared_service_elastic_stack_01_hostname }}:{{ service_port_elasticsearch }}"]
+                cacert => "/usr/share/logstash/config/certificates/ca/ca.crt"
+                user => "{{ elastic_admin_username }}"
+                password => "{{ elastic_admin_password }}"
 
-            index => "uncategorized-kubernetes-%{[kubernetes][namespace]}-%{+YYYY.MM}"
+                index => "%{[stage]}-%{[kubernetes][namespace]}-%{[kubernetes][job][name]}-%{+YYYY.MM}"
 
-            manage_template => false
-       }
+                manage_template => false
+           }
+        }
+        else if [kubernetes][pod][name] {
+            elasticsearch {
+                hosts => ["https://{{ shared_service_elastic_stack_01_hostname }}:{{ service_port_elasticsearch }}"]
+                cacert => "/usr/share/logstash/config/certificates/ca/ca.crt"
+                user => "{{ elastic_admin_username }}"
+                password => "{{ elastic_admin_password }}"
+
+                index => "%{[stage]}-%{[kubernetes][namespace]}-%{[kubernetes][pod][name]}-%{+YYYY.MM}"
+
+                manage_template => false
+           }
+        }
+        else {
+            elasticsearch {
+                hosts => ["https://{{ shared_service_elastic_stack_01_hostname }}:{{ service_port_elasticsearch }}"]
+                cacert => "/usr/share/logstash/config/certificates/ca/ca.crt"
+                user => "{{ elastic_admin_username }}"
+                password => "{{ elastic_admin_password }}"
+
+                index => "uncategorized-kubernetes-%{[kubernetes][namespace]}-%{+YYYY.MM}"
+
+                manage_template => false
+           }
+        }
     }
     else if [container][name] and [@metadata][beat] {
         elasticsearch {