Add further documentation for Logstash volumes

config/recipes/logstash/logstash-eck.yaml

@@ -93,7 +93,7 @@ spec:
             hosts => [ "${ECK_ES_HOSTS}" ]
             user => "${ECK_ES_USER}"
             password => "${ECK_ES_PASSWORD}"
-            cacert => "${ECK_ES_SSL_CERTIFICATE_AUTHORITY}"
+            ssl_certificate_authorities => "${ECK_ES_SSL_CERTIFICATE_AUTHORITY}"
           }
         }
   services:

config/recipes/logstash/logstash-es-role.yaml

@@ -42,8 +42,8 @@ spec:
         output { 
           elasticsearch {
             hosts => [ "${ECK_ES_HOSTS}" ]
-            ssl => true
-            cacert => "${ECK_ES_SSL_CERTIFICATE_AUTHORITY}"
+            ssl_enabled => true
+            ssl_certificate_authorities => "${ECK_ES_SSL_CERTIFICATE_AUTHORITY}"
             user => "${ECK_ES_USER}"
             password => "${ECK_ES_PASSWORD}"
             index => "my-index"

config/recipes/logstash/logstash-monitored.yaml

@@ -97,7 +97,7 @@ spec:
             hosts => [ "${ECK_ES_HOSTS}" ]
             user => "${ECK_ES_USER}"
             password => "${ECK_ES_PASSWORD}"
-            cacert => "${ECK_ES_SSL_CERTIFICATE_AUTHORITY}"
+            ssl_certificate_authorities => "${ECK_ES_SSL_CERTIFICATE_AUTHORITY}"
           }
         }
   services:

config/recipes/logstash/logstash-multi.yaml

@@ -122,7 +122,7 @@ spec:
             hosts => [ "${PROD_ES_ES_HOSTS}" ]
             user => "${PROD_ES_ES_USER}"
             password => "${PROD_ES_ES_PASSWORD}"
-            cacert => "${PROD_ES_ES_SSL_CERTIFICATE_AUTHORITY}"
+            ssl_certificate_authorities => "${PROD_ES_ES_SSL_CERTIFICATE_AUTHORITY}"
           }
         }
     - pipeline.id: qa
@@ -137,7 +137,7 @@ spec:
             hosts => [ "${QA_ES_ES_HOSTS}" ]
             user => "${QA_ES_ES_USER}"
             password => "${QA_ES_ES_PASSWORD}"
-            cacert => "${QA_ES_ES_SSL_CERTIFICATE_AUTHORITY}"
+            ssl_certificate_authorities => "${QA_ES_ES_SSL_CERTIFICATE_AUTHORITY}"
           }
         }
   services:

config/recipes/logstash/logstash-pipeline-as-secret.yaml

@@ -111,6 +111,6 @@ stringData:
             hosts => [ "${ECK_ES_HOSTS}" ]
             user => "${ECK_ES_USER}"
             password => "${ECK_ES_PASSWORD}"
-            cacert => "${ECK_ES_SSL_CERTIFICATE_AUTHORITY}"
+            ssl_certificate_authorities => "${ECK_ES_SSL_CERTIFICATE_AUTHORITY}"
           }
         }

config/recipes/logstash/logstash-pipeline-as-volume.yaml

@@ -124,6 +124,6 @@ stringData:
         hosts => [ "${ECK_ES_HOSTS}" ]
         user => "${ECK_ES_USER}"
         password => "${ECK_ES_PASSWORD}"
-        cacert => "${ECK_ES_SSL_CERTIFICATE_AUTHORITY}"
+        ssl_certificate_authorities => "${ECK_ES_SSL_CERTIFICATE_AUTHORITY}"
       }
     }

config/recipes/logstash/logstash-volumes.yaml

@@ -0,0 +1,156 @@
+---
+apiVersion: elasticsearch.k8s.elastic.co/v1
+kind: Elasticsearch
+metadata:
+  name: elasticsearch
+spec:
+  version: 8.8.0
+  nodeSets:
+    - name: default
+      count: 3
+      config:
+        # This setting has performance implications. See the README for more details.
+        node.store.allow_mmap: false
+---
+apiVersion: beat.k8s.elastic.co/v1beta1
+kind: Beat
+metadata:
+  name: filebeat
+spec:
+  type: filebeat
+  version: 8.8.0
+  config:
+    filebeat.inputs:
+      - type: log
+        paths:
+          - /data/logstash-tutorial.log
+    output.logstash:
+      hosts: ["logstash-ls-beats:5044"]
+  deployment:
+    podTemplate:
+      spec:
+        automountServiceAccountToken: true
+        initContainers:
+          - name: download-tutorial
+            image: curlimages/curl
+            command: ["/bin/sh"]
+            args: ["-c", "curl -L https://download.elastic.co/demos/logstash/gettingstarted/logstash-tutorial.log.gz | gunzip -c > /data/logstash-tutorial.log"]
+            volumeMounts:
+              - name: data
+                mountPath: /data
+        containers:
+          - name: filebeat
+            volumeMounts:
+              - name: data
+                mountPath: /data
+              - name: beat-data
+                mountPath: /usr/share/filebeat/data
+        volumes:
+          - name: data
+            emptydir: {}
+          - name: beat-data
+            emptydir: {}
+---
+apiVersion: logstash.k8s.elastic.co/v1alpha1
+kind: Logstash
+metadata:
+  name: logstash
+spec:
+  count: 1
+  version: 8.8.0
+  elasticsearchRefs:
+    - clusterName: eck
+      name: elasticsearch
+  podTemplate:
+    spec:
+      containers:
+        - name: logstash
+          volumeMounts:
+            - mountPath: /usr/share/logstash/pq
+              name: pq
+              readOnly: false
+            - mountPath: /usr/share/logstash/dlq
+              name: dlq
+              readOnly: false
+  volumeClaimTemplates:
+    - metadata:
+        name: pq
+      spec:
+        accessModes:
+          - ReadWriteOnce
+        resources:
+          requests:
+            storage: 10Gi
+    - metadata:
+        name: dlq
+      spec:
+        accessModes:
+          - ReadWriteOnce
+        resources:
+          requests:
+            storage: 5Gi
+  pipelines:
+    - pipeline.id: dlq_read
+      dead_letter_queue.enable: false
+      config.string: |
+        input {
+          dead_letter_queue {
+            path => "/usr/share/logstash/dlq"
+            commit_offsets => true
+            pipeline_id => "beats"
+            clean_consumed => true
+          }
+        }
+        filter {
+          mutate {
+            remove_field => "[geoip][location]"
+          }
+        }
+        output {
+          elasticsearch {
+            hosts => [ "${ECK_ES_HOSTS}" ]
+            user => "${ECK_ES_USER}"
+            password => "${ECK_ES_PASSWORD}"
+            ssl_certificate_authorities => "${ECK_ES_SSL_CERTIFICATE_AUTHORITY}"
+          }
+        }
+    - pipeline.id: beats
+      dead_letter_queue.enable: true
+      path.dead_letter_queue: /usr/share/logstash/dlq
+      config.string: |
+        input {
+          beats {
+            port => 5044
+          }
+        }
+        filter {
+          grok {
+            match => { "message" => "%{HTTPD_COMMONLOG}"}
+          }
+          geoip {
+            source => "[source][address]"
+            target => "[source]"
+          }
+        }
+        output {
+          elasticsearch {
+            hosts => [ "${ECK_ES_HOSTS}" ]
+            user => "${ECK_ES_USER}"
+            password => "${ECK_ES_PASSWORD}"
+            ssl_certificate_authorities => "${ECK_ES_SSL_CERTIFICATE_AUTHORITY}"
+          }
+        }
+  config:
+    log.level: info
+    queue.type: persisted
+    path.queue: /usr/share/logstash/pq
+  services:
+    - name: beats
+      service:
+        spec:
+          type: ClusterIP
+          ports:
+            - port: 5044
+              name: "filebeat"
+              protocol: TCP
+              targetPort: 5044