---
apiVersion: v1
kind: ConfigMap
metadata:
  name: filebeat-config-infra
  namespace: kube-system
  labels:
    k8s-app: filebeat
data:
  filebeat.yml: |-
    logging.level: info
    filebeat.inputs:
      - type: log
        paths:
          - /var/log/kube-apiserver/audit.log
          - /var/log/openshift-apiserver/audit.log
        json.keys_under_root: true
        json.add_error_key: true
        processors:
          - drop_event:
              when:
                not:
                  or:
                    - equals:
                        verb: delete
                    - equals:
                        verb: update
          - add_fields:
              target: log
              fields:
                level: "info"
    filebeat.modules:
      - module: auditd
        log:
          enabled: true
          var.paths:
            - /var/log/audit/audit.log

    filebeat.autodiscover:
      providers:
        - type: kubernetes
          include_pod_uid: true
          in_cluster: false
          include_annotations: '*'
          node: ${NODE_NAME}
          templates:
            - condition:
               and:
                 - or:
                   - contains:
                       kubernetes.namespace: "openshift"
                   - contains:
                       kubernetes.namespace: "default"
                   - contains:
                       kubernetes.namespace: "dns-updater"
                   - contains:
                       kubernetes.namespace: "f5-lb"
                   - contains:
                       kubernetes.namespace: "istio-system"
                   - contains:
                       kubernetes.namespace: "kube"
                   - contains:
                       kubernetes.namespace: "node-gather"
                   - contains:
                       kubernetes.namespace: "orchestrator"
                   - contains:
                       kubernetes.namespace: "trident"
                 - not:
                    contains:
                      kubernetes.container.name: "filebeat"
              config:
                - type: docker
                  combine_partial: true
                  cri.parse_flags: true
                  cri.force: true
                  containers:
                    path: "/var/log/pods/${data.kubernetes.namespace}_${data.kubernetes.pod.name}_${data.kubernetes.pod.uid}"
                    ids:
                      - "${data.kubernetes.container.name}"
                  processors:
                    - dissect:
                        tokenizer: "%{key3} %{key4}"
                        field: "message"
                        target_prefix: ""
                    - script:
                        lang: javascript
                        id: my_filter
                        source: >
                          function process(event) {
                              var message = event.Get("message");
                              var flag = false;
                              if (message.charAt(0) == '{') {
                                  event.Put("json", message);
                                  flag = true;
                              }
                              if (!event.Get("log.flags") && !flag) {
                                  var key3 = event.Get("key3");
                                  var level = key3.charAt(0);
                                  switch(level) {
                                    case 'T':
                                      event.Put("log.level", "Debug");
                                      break;
                                    case 'I':
                                      event.Put("log.level", "Info");
                                      break;
                                    case 'E':
                                      event.Put("log.level", "Error");
                                      break;
                                    case 'N':
                                      event.Put("log.level", "Notice");
                                      break;
                                    case 'W':
                                      event.Put("log.level", "Warning");
                                      break;
                                    case 'F':
                                      event.Put("log.level", "Critical");
                                      break;
                                    case 'D':
                                      event.Put("log.level", "Debug");
                                      break;
                                    default:
                                      event.Put("log.level", "Unknown");
                                  }
                                }
                              }
          hints.enabled: true
    processors:
      - add_cloud_metadata:
      - add_host_metadata:
      - add_labels:
          labels:
            log.category: infra
            datacenter: {{ datacenter }}
      - if:
          and:
            - or:
              - contains:
                  log.flags: "dissect_parsing_error"
              - contains:
                  log.level: "Unknown"
            - equals:
                kubernetes.container.name: "cluster-version-operator"
            - contains:
                message: "failure"
        then:
          - drop_fields:
              fields: ["log.level"]
              ignore_missing: true
          - add_fields:
              target: log
              fields:
                level: "error"

      - if:
          has_fields: ['json']
        then:
          - decode_json_fields:
              fields: ["json"]
              target: "json"
              overwrite_keys: true
              add_error_key: true
          - drop_fields:
              fields: ["log.level"]
              ignore_missing: true
          - rename:
              when:
                has_fields: ["json.level"]
              fields:
                - from: "json.level"
                  to: "log.level"
          - add_fields:
              when:
                not:
                  has_fields: ["json.level"]
              target: log
              fields: 
                level: "info"
      - if: 
          and:
            - contains:
                log.level: "Unknown"
            - or:
              - equals:
                  kubernetes.container.name: "trident-operator"
              - equals:
                  kubernetes.container.name: "node-exporter"
              - equals:
                  kubernetes.container.name: "trident-main"
              - equals:
                  kubernetes.container.name: "olm-operator"
              - equals:
                  kubernetes.container.name: "marketplace-operator"
              - equals:
                  kubernetes.container.name: "alertmanager"
              - equals:
                  kubernetes.container.name: "cloud-credential-operator"
              - equals:
                  kubernetes.container.name: "packageserver"
              - equals:
                  kubernetes.container.name: "catalog-operator"
              - equals:
                  kubernetes.container.name: "prometheus"
              - equals:
                  kubernetes.container.name: "trident-autosupport"
              - contains:
                  kubernetes.container.name: "thanos"
              - equals:
                  kubernetes.container.name: "config-reloader"
        then:
          - dissect:
              tokenizer: "%{}level=%{log.level} %{}"
              field: "message"
              overwrite_keys: true
              target_prefix: ""
      - if:
          and:
            - contains:
                log.level: "Unknown"
            - or:
              - equals:
                  kubernetes.container.name: "metal3-ironic-api"
              - equals:
                  kubernetes.container.name: "metal3-ironic-inspector"
              - equals:
                  kubernetes.container.name: "metal3-ironic-conductor"
        then:
          - dissect:
              tokenizer: "%{} %{} %{} %{log.level} %{}"
              field: "message"
              overwrite_keys: true
              target_prefix: ""
      - if:
          and:
            - contains:
                log.level: "Unknown"
            - or:
              - equals:
                  kubernetes.container.name: "fluentd"
              - equals:
                  kubernetes.container.name: "metal3-mariadb"
        then:
          - dissect:
              tokenizer: "%{} %{} %{} [%{log.level}]%{}"
              field: "message"
              overwrite_keys: true
              target_prefix: ""

      - if:
          and:
            - contains:
                log.level: "Unknown"
            - or:
              - equals:
                  kubernetes.container.name: "metal3-httpd"
        then:
          - drop_fields:
              fields: ["log.level"]
          - dissect:
              tokenizer: "%{} \"%{}\" %{http.status} %{}"
              field: "message"
              overwrite_keys: true
              target_prefix: ""
          - dissect:
              when: 
                contains:
                  log.flags: "dissect_parsing_error"
              tokenizer: "[%{}] [%{}:%{log.level}] %{}"
              overwrite_keys: true
              target_prefix: ""
          - script:
              lang: javascript
              id: metal3_httpd_script
              source: >
                  function process(event) {
                              if (event.Get("http.status")) {
                                  var http_status = event.Get("http.status");
                                  var level = http_status.charAt(0);
                                  switch(level) {
                                    case '2':
                                      event.Put("log.level", "Info");
                                      break;
                                    case '3':
                                      event.Put("log.level", "Info");
                                      break;
                                    case '4':
                                      event.Put("log.level", "Warning");
                                      break;
                                    case '5':
                                      event.Put("log.level", "Warning");
                                      break;
                                    default:
                                      event.Put("log.level", "Unknown");
                                  }
                                }
                   }

 
      - if:
          and:
            - not:
                has_fields: ["log.level"]
            - or:
              - equals:
                  kubernetes.container.name: "installer"
              - equals:
                  kubernetes.container.name: "kube-multus"
        then:
          - add_fields:
              target: log
              fields:
                 level: info
      - if:
          and:
            - contains:
                log.level: "Unknown"
            - or:
              - equals:
                  kubernetes.container.name: "modelruntime"
        then:
          - dissect:
              tokenizer: "%{} %{}-%{log.level}-%{}"
              field: "message"
              overwrite_keys: true
              target_prefix: ""
      - if:
          and:
            - contains:
                log.level: "Unknown"
            - or:
              - equals:
                  kubernetes.container.name: "tuned"
        then:
          - dissect:
              tokenizer: "%{} %{} %{log.level} %{}"
              field: "message"
              overwrite_keys: true
              target_prefix: ""
      - if:
          and:
            - contains:
                log.level: "Unknown"
            - equals:
                kubernetes.container.name: "dns"
            - regexp:
                message: "^\\["
        then:
          - dissect:
              tokenizer: "[%{log.level}] %{}"
              field: "message"
              overwrite_keys: true
              target_prefix: ""
      - if:
          and:
            - contains:
                log.level: "Unknown"
            - equals:
                kubernetes.container.name: "virt-controller"
            - regexp:
                message: "^[0-9]+"
        then:
          - dissect:
              tokenizer: "%{} %{} %{log.level}: %{}"
              field: "message"
              overwrite_keys: true
              target_prefix: ""

      - if:
          and:
            - contains:
                log.level: "Unknown"
            - or:
              - equals:
                  kubernetes.container.name: "sp-app"
        then:
          - dissect:
              tokenizer: "%{} %{} - %{} - %{log.level} - %{}"
              field: "message"
              overwrite_keys: true
              target_prefix: ""
      - if:
          and:
            - contains:
                log.level: "Unknown"
            - or:
              - equals:
                  kubernetes.container.name: "ovs-daemons"
              - equals:
                  kubernetes.container.name: "northd"
              - equals:
                  kubernetes.container.name: "sbdb"
              - equals:
                  kubernetes.container.name: "ovn-controller"
              - equals:
                  kubernetes.container.name: "nbdb"
        then:
          - dissect:
              tokenizer: "%{}|%{}|%{}|%{log.level}|%{}"
              field: "message"
              overwrite_keys: true
              target_prefix: ""
      - if:
          and:
            - contains:
                log.level: "Unknown"
            - or:
              - equals:
                  kubernetes.container.name: "k8s-bigip-ctlr"
        then:
          - dissect:
              tokenizer: "%{} %{} [%{log.level}] %{}"
              field: "message"
              overwrite_keys: true
              target_prefix: ""
      - if:
          and:
            - contains:
                log.level: "Unknown"
            - equals:
                kubernetes.container.name: "tcpdump-cronjob"
        then:
          - dissect:
              tokenizer: "%{} %{} - tcpdump-app - %{log.level} - %{}"
              field: "message"
              overwrite_keys: true
              target_prefix: ""

      - if:
          and:
            - contains:
                log.level: "Unknown"
            - contains:
                kubernetes.container.name: "telegraf"
        then:
          - dissect:
              tokenizer: "%{} %{log.level.temp}! %{}"
              field: "message"
              overwrite_keys: true
              target_prefix: ""
          - script:
              lang: javascript
              id: telegraf
              source: >
                function process(event) {
                    var level = event.Get("log.level.temp");
                    switch(level) {
                      case 'T':
                        event.Put("log.level", "Debug");
                        break;
                      case 'I':
                        event.Put("log.level", "Info");
                        break;
                      case 'E':
                        event.Put("log.level", "Error");
                        break;
                      case 'N':
                        event.Put("log.level", "Notice");
                        break;
                      case 'W':
                        event.Put("log.level", "Warning");
                        break;
                      case 'F':
                        event.Put("log.level", "Critical");
                        break;
                      case 'D':
                        event.Put("log.level", "Debug");
                        break;
                      default:
                        event.Put("log.level", "Unknown");
                    }
                }
          - drop_fields:
              fields: ["log.level.temp"]
              ignore_missing: true
      - if:
          and:
            - contains:
                log.level: "Unknown"
            - or:
              - equals:
                  kubernetes.container.name: "cassandra-exporter"
        then:
          - dissect:
              tokenizer: "%{} %{log.level} %{}"
              field: "message"
              overwrite_keys: true
              target_prefix: ""
      - if:
          and:
            - contains:
                log.level: "Unknown"
            - or:
              - contains:
                  kubernetes.container.name: "filebeat"
              - equals:
                  kubernetes.container.name: "aspen-mesh-secure-ingress"
              - equals:
                  kubernetes.container.name: "citadel"
              - equals:
                  kubernetes.container.name: "discovery"
              - equals:
                  kubernetes.container.name: "istio-proxy"
              - equals:
                  kubernetes.container.name: "ingress-operator"
        then:
          - dissect:
              tokenizer: "%{}	%{log.level}	%{}"
              field: "message"
              overwrite_keys: true
              target_prefix: ""
      - if:
          and:
            - contains:
                log.level: "0"
            - regexp:
                message: "error"
        then:
          - drop_fields:
              fields: ["log.level"]
          - add_fields:
              target: log
              fields:
                level: "error"

      - if:
          and:
            - or:
              - contains:
                  log.flags: "dissect_parsing_error"
              - contains:
                  log.level: "Unknown"
            - or:
              - equals:
                  kubernetes.container.name: "aspen-mesh-packet-inspector"
              - equals:
                  kubernetes.container.name: "ldap-group-sync-uswin"
              - equals:
                  kubernetes.container.name: "container-00"
              - equals:
                  kubernetes.container.name: "discovery"
              - equals:
                  kubernetes.container.name: "k8s-bigip-ctlr"
              - equals:
                  kubernetes.container.name: "ovs-daemons"
              - equals:
                  kubernetes.container.name: "trident-main"
              - equals:
                  kubernetes.container.name: "kubevirt-ssp-operator"
              - equals:
                  kubernetes.container.name: "prometheus-proxy"
              - equals:
                  kubernetes.container.name: "metal3-ironic-conductor"
              - equals:
                  kubernetes.container.name: "metal3-static-ip-manager"
              - equals:
                  kubernetes.container.name: "sriov-network-operator"
              - equals:
                  kubernetes.container.name: "dns-operator"
              - equals:
                  kubernetes.container.name: "metal3-dnsmasq"
              - equals:
                  kubernetes.container.name: "metrics-collector"
              - equals:
                  kubernetes.container.name: "prometheus-operator"
              - equals:
                  kubernetes.container.name: "openshift-authentication-operator"
              - equals:
                  kubernetes.container.name: "grafana-proxy"
              - equals:
                  kubernetes.container.name: "grafana"
              - equals:
                  kubernetes.container.name: "machine-controller"
              - equals:
                  kubernetes.container.name: "cluster-network-addons-operator"
              - equals:
                  kubernetes.container.name: "network-operator"
              - equals:
                  kubernetes.container.name: "download-server"
              - equals:
                  kubernetes.container.name: "authentication-operator"
              - contains:
                  kubernetes.container.name: "telegraf"
              - equals:
                  kubernetes.container.name: "tcpdump-cronjob"
              - equals:
                  kubernetes.container.name: "cluster-version-operator"
              - equals:
                  kubernetes.container.name: "alertmanager-proxy"
              - equals:
                  kubernetes.container.name: "kube-rbac-proxy"
              - equals:
                  kubernetes.container.name: "ovnkube-node"
              - equals:
                  kubernetes.container.name: "installer"
              - equals:
                  kubernetes.container.name: "machine-config-daemon"
              - equals:
                  kubernetes.container.name: "install-cni"
              - equals:
                  kubernetes.container.name: "console"
              - equals:
                  kubernetes.container.name: "kube-multus"
              - equals:
                  kubernetes.container.name: "ovn-controller"
              - equals:
                  kubernetes.container.name: "cdi-apiserver"
              - equals:
                  kubernetes.container.name: "pruner"
              - equals:
                  kubernetes.container.name: "kube-apiserver-operator"
              - equals:
                  kubernetes.container.name: "ovnkube-master"
              - equals:
                  kubernetes.container.name: "oauth-openshift"
              - equals:
                  kubernetes.container.name: "dns"
              - equals:
                  kubernetes.container.name: "virt-controller"
              - contains:
                  kubernetes.container.name: "openshift-apiserver"
              - equals:
                  kubernetes.container.name: "webhook-server"
              - equals:
                  kubernetes.container.name: "nmstate-handler"
              - contains:
                  kubernetes.container.name: "controller-manager-operator"
              - contains:
                  kubernetes.container.name: "fluentd"
              - equals:
                  kubernetes.container.name: "prometheus"
              - equals:
                  kubernetes.container.name: "metal3-mariadb"
              - equals:
                  kubernetes.container.name: "packageserver"
              - equals:
                  kubernetes.container.name: "modelruntime"
              - equals:
                  kubernetes.container.name: "metal3-machine-os-downloader"
              - equals:
                  kubernetes.container.name: "sp-app"
              - equals:
                  kubernetes.container.name: "prom-label-proxy"
              - equals:
                  kubernetes.container.name: "image-pruner"
              - equals:
                  kubernetes.container.name: "metal3-ironic-inspector"
              - equals:
                  kubernetes.container.name: "istiod-cassandra"
              - equals:
                  kubernetes.container.name: "cni-plugins"
                   
        then:
          - drop_event:

      - add_fields:
          target: log
          fields:
            level: info
          when:
            equals:
              kubernetes.container.name: "oauth-proxy"

      - add_fields:
          target: log
          fields:
            level: info
          when:
            equals:
              event.module: "auditd"
      - drop_fields:
            fields: ["key3", "key4","json"]
            ignore_missing: true
      - script:
            lang: javascript
            id: lowercase
            source: >
              function process(event) {
                  var level = event.Get("log.level");
                  if(level != null) {
                      event.Put("log.level", level.toString().toLowerCase());
                  }
              }

      - if:
          and:
            - not:
                or:
                  - equals:
                      log.level: info
                  - equals:
                      log.level: warning
                  - equals:
                      log.level: debug
                  - equals:
                      log.level: notice
                  - equals:
                      log.level: critical
                  - equals:
                      log.level: panic
                  - equals:
                      log.level: error
                  - equals:
                      log.level: fatal
            - or:
              - equals:
                  kubernetes.container.name: "multus-admission-controller"
              - equals:
                  kubernetes.container.name: "oauth-apiserver"
              - equals:
                  kubernetes.container.name: "metal3-ironic-conductor"
              - equals:
                  kubernetes.container.name: "gather"
        then:
          - drop_fields:
              fields: ["log.level"]
          - add_fields:
              when:
                contains:
                  message: "error"
              target: log
              fields:
                 level: error
          - add_fields:
              when:
                and:
                - contains:
                    message: "warn"
                - not:
                    has_fields: ["log.level"]
              target: log
              fields:
                 level: warning
          - add_fields:
              when:
                not:
                  has_fields: ["log.level"]
              target: log
              fields:
                 level: info

      - if:
         contains:
           log.level: "err"
        then:
          - drop_fields:
              fields: ["log.level"]
          - add_fields:
              target: log
              fields:
                 level: "error"

      - if:
         contains:
           log.level: "warn"
        then:
          - drop_fields:
              fields: ["log.level"]
          - add_fields:
              target: log
              fields:
                 level: "warning"

      - if:
         contains:
           log.level: "not"
        then:
          - drop_fields:
              fields: ["log.level"]
          - add_fields:
              target: log
              fields:
                 level: "notice"

      - if:
          not:
            or:
              - equals:
                  log.level: info
              - equals:
                  log.level: warning
              - equals:
                  log.level: debug
              - equals:
                  log.level: notice
              - equals:
                  log.level: critical
              - equals:
                  log.level: panic
              - equals:
                  log.level: error
              - equals:
                  log.level: fatal
        then:
          - drop_fields:
              fields: ["log.level"]
          - add_fields:
              target: log
              fields:
                 level: "unknown"

      - if:
          and:
            - or: 
               - contains:
                   log.level: "debug" 
               - contains:
                   log.level: "info"
            - not:
                or:
                 - contains:
                     log.file.path: "audit.log"
                 - equals:
                     event.module: "auditd"
        then:
          - drop_event:
 

    output.kafka:
      hosts: ["{{kafka_brokers | join('')}}"]
      topic: {{ kafka_topic }}_{{region}}
{% if kafka_ssl is sameas true %}
      ssl.enabled: true
      ssl.verification_mode: none
      ssl.certificate_authorities: ["/etc/kafka-certs/ca.cer.pem"]
      ssl.certificate: "/etc/kafka-certs/client.cer.pem"
      ssl.key: "/etc/kafka-certs/client.key.pem"
{% endif %}
      partition.round_robin:
        reachable_only: false
      required_acks: 1
      compression: gzip
      max_message_bytes: 1000000
{% if send_app_logs_to_ns is sameas true %}
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: filebeat-config-app
  namespace: kube-system
  labels:
    k8s-app: filebeat
data:
  filebeat.yml: |-
    filebeat.autodiscover:
      providers:
        - type: kubernetes
          include_pod_uid: true
          in_cluster: false
          include_annotations: '*'
          node: ${NODE_NAME}
          templates:
            - condition:
               not:
                 and:
                   - or:
                     - contains:
                         kubernetes.namespace: "openshift"
                     - contains:
                         kubernetes.namespace: "default"
                     - contains:
                         kubernetes.namespace: "dns-updater"
                     - contains:
                         kubernetes.namespace: "f5-lb"
                     - contains:
                         kubernetes.namespace: "istio-system"
                     - contains:
                         kubernetes.namespace: "kube"
                     - contains:
                         kubernetes.namespace: "node-gather"
                     - contains:
                         kubernetes.namespace: "orchestrator"
                     - contains:
                         kubernetes.namespace: "trident"
                   - not:
                      contains:
                        kubernetes.container.name: "filebeat"
              config:
                - type: docker
                  combine_partial: true
                  cri.parse_flags: true
                  cri.force: true
                  containers:
                    path: "/var/log/pods/${data.kubernetes.namespace}_${data.kubernetes.pod.name}_${data.kubernetes.pod.uid}"
                    ids:
                      - "${data.kubernetes.container.name}"
                  processors:
                    - add_labels:
                        labels:
                          log.category: app
                          datacenter: {{ datacenter }}
          hints.enabled: true
    processors:
      - add_cloud_metadata:
      - add_host_metadata:
      - drop_fields:
          fields: ["kubernetes.node.labels", "host.mac", "host.os", "host.architecture", "host.ip"]

    output.logstash:
      hosts: ["{{ ns_namespace_serviceaddress }}:{{ ns_namespace_service_port }}"]
{% endif %}
{% if kafka_ssl is sameas true %}
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: filebeat-infra-kafka-certs
  namespace: kube-system
data:
  ca.cer.pem: |
    {{ ca_cer_pem | indent( width=4, indentfirst=False) }}
  client.cer.pem: |
    {{ client_cer_pem | indent( width=4, indentfirst=False) }}
  client.key.pem: |
    {{ client_key_pem | indent( width=4, indentfirst=False) }}
{% endif %}
---
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: filebeat
  namespace: kube-system
  labels:
    k8s-app: filebeat
spec:
  selector:
    matchLabels:
      k8s-app: filebeat
  template:
    metadata:
      labels:
        k8s-app: filebeat
    spec:
      tolerations:
      - key: node-role.kubernetes.io/master
        effect: NoSchedule
      - operator: Exists
      # this toleration is to have the daemonset runnable on master nodes
      # remove it if your masters can't run pods
      serviceAccountName: filebeat
      nodeSelector:
        kubernetes.io/os: linux
      terminationGracePeriodSeconds: 30
      hostNetwork: true
      dnsPolicy: ClusterFirstWithHostNet
      containers:
      - name: filebeat-infra
        image: {{ filebeat_image }}
        args: [
          "-c", "/etc/filebeat.yml",
          "-e",
        ]
        env:
        - name: NODE_NAME
          valueFrom:
            fieldRef:
              fieldPath: spec.nodeName
        securityContext:
          runAsUser: 0
          # If using Red Hat OpenShift uncomment this:
          privileged: true
        resources:
          limits:
            cpu: {{ filebeat_infra_cpu_limit }}
            memory: {{ filebeat_infra_mem_limit }} 
          requests:
            cpu: {{ filebeat_infra_cpu_requests }}
            memory: {{ filebeat_infra_mem_requests }}
        volumeMounts:
{% if kafka_ssl is sameas true %}
        - name: kafka-certs
          mountPath: /etc/kafka-certs
          readOnly: true       
{% endif %}         
        - name: config-infra
          mountPath: /etc/filebeat.yml
          readOnly: true
          subPath: filebeat.yml
        - name: data-infra
          mountPath: /usr/share/filebeat/data
        - name: varlog
          mountPath: /var/log
          readOnly: true
{% if send_app_logs_to_ns is sameas true %}          
      - name: filebeat-app
        image: {{ filebeat_image }}
        args: [
          "-c", "/etc/filebeat.yml",
          "-e",
        ]
        env:
        - name: NODE_NAME
          valueFrom:
            fieldRef:
              fieldPath: spec.nodeName
        securityContext:
          runAsUser: 0
          # If using Red Hat OpenShift uncomment this:
          privileged: true
        resources:
          limits:
            cpu: {{ filebeat_app_cpu_limit }}
            memory: {{ filebeat_app_mem_limit }}
          requests:
            cpu: {{ filebeat_app_cpu_requests }}
            memory: {{ filebeat_app_mem_requests }}
        volumeMounts:
        - name: config-app
          mountPath: /etc/filebeat.yml
          readOnly: true
          subPath: filebeat.yml
        - name: data-app
          mountPath: /usr/share/filebeat/data
        - name: varlog
          mountPath: /var/log
          readOnly: true
{% endif %}          
      volumes:
      - name: config-infra
        configMap:
          defaultMode: 0640
          name: filebeat-config-infra
{% if kafka_ssl is sameas true %}
      - name: kafka-certs
        configMap:
          defaultMode: 0640
          name: filebeat-infra-kafka-certs
          items:
          - key: ca.cer.pem
            path: ca.cer.pem
          - key: client.cer.pem
            path: client.cer.pem
          - key: client.key.pem
            path: client.key.pem
{% endif %}
{% if send_app_logs_to_ns is sameas true %}
      - name: config-app
        configMap:
          defaultMode: 0640
          name: filebeat-config-app
{% endif %}           
      - name: varlog
        hostPath:
          path: /var/log
      # data folder stores a registry of read status for all files, so we don't send everything again on a Filebeat pod restart
      - name: data-infra
        hostPath:
          # When filebeat runs as non-root user, this directory needs to be writable by group (g+w).
          path: /var/lib/filebeat-data-infra
          type: DirectoryOrCreate
{% if send_app_logs_to_ns is sameas true %}           
      - name: data-app
        hostPath:
          # When filebeat runs as non-root user, this directory needs to be writable by group (g+w).
          path: /var/lib/filebeat-data-app
          type: DirectoryOrCreate
{% endif %}
