From ada5dbd21562ef227292f6bd841e848c2ee749e9 Mon Sep 17 00:00:00 2001
From: Shane Starcher <shanestarcher@gmail.com>
Date: Tue, 27 Mar 2018 17:27:03 -0400
Subject: [PATCH] Filebeat k8s fix (#4408)

* upgrade filebeat to 6.2.3 to prevent k8s metadata infinite loop

* fix filebeat /var/log and drop seperate prospectors configuration

* fix linting

Signed-off-by: voron <av@arilot.com>
---
 stable/filebeat/Chart.yaml                      |  4 ++--
 stable/filebeat/templates/daemonset.yaml        | 12 ++++++------
 .../templates/prospectors-configmap.yaml        | 17 -----------------
 stable/filebeat/values.yaml                     | 17 ++++++++++++-----
 4 files changed, 20 insertions(+), 30 deletions(-)
 delete mode 100644 stable/filebeat/templates/prospectors-configmap.yaml

diff --git a/stable/filebeat/Chart.yaml b/stable/filebeat/Chart.yaml
index 8fe93c7bfa49..bc49c439b056 100644
--- a/stable/filebeat/Chart.yaml
+++ b/stable/filebeat/Chart.yaml
@@ -2,8 +2,8 @@ apiVersion: v1
 description: A Helm chart to collect Kubernetes logs with filebeat
 icon: https://www.elastic.co/assets/blt47799dcdcf08438d/logo-elastic-beats-lt.svg
 name: filebeat
-version: 0.1.0
-appVersion: 6.2.2
+version: 0.1.1
+appVersion: 6.2.3
 sources:
 - https://www.elastic.co/guide/en/beats/filebeat/current/index.html
 maintainers:
diff --git a/stable/filebeat/templates/daemonset.yaml b/stable/filebeat/templates/daemonset.yaml
index 46b0c9793089..1bd125304000 100644
--- a/stable/filebeat/templates/daemonset.yaml
+++ b/stable/filebeat/templates/daemonset.yaml
@@ -43,24 +43,24 @@ spec:
           mountPath: /usr/share/filebeat/filebeat.yml
           readOnly: true
           subPath: filebeat.yml
-        - name: prospectors-config
-          mountPath: /usr/share/filebeat/prospectors.d
-          readOnly: true
         - name: data
           mountPath: /usr/share/filebeat/data
+        - name: varlog
+          mountPath: /var/log
+          readOnly: true          
         - name: varlibdockercontainers
           mountPath: /var/lib/docker/containers
           readOnly: true
       volumes:
+      - name: varlog
+        hostPath:
+          path: /var/log
       - name: varlibdockercontainers
         hostPath:
           path: /var/lib/docker/containers
       - name: filebeat-config
         secret:
           secretName: {{ template "filebeat.fullname" . }}
-      - name: prospectors-config
-        configMap:
-          name: {{ template "filebeat.fullname" . }}-prospectors
       - name: data
         hostPath:
           path: /var/lib/filebeat
diff --git a/stable/filebeat/templates/prospectors-configmap.yaml b/stable/filebeat/templates/prospectors-configmap.yaml
deleted file mode 100644
index 3a2852e3b157..000000000000
--- a/stable/filebeat/templates/prospectors-configmap.yaml
+++ /dev/null
@@ -1,17 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: {{ template "filebeat.fullname" . }}-prospectors
-  labels:
-    app: {{ template "filebeat.name" . }}
-    chart: {{ template "filebeat.chart" . }}
-    release: {{ .Release.Name }}
-    heritage: {{ .Release.Service }}   
-data:
-  kubernetes.yml: |-
-    - type: docker
-      containers.ids:
-      - "*"
-      processors:
-        - add_kubernetes_metadata:
-            in_cluster: true
diff --git a/stable/filebeat/values.yaml b/stable/filebeat/values.yaml
index af17adfe04b8..c8a48184fdcf 100644
--- a/stable/filebeat/values.yaml
+++ b/stable/filebeat/values.yaml
@@ -1,6 +1,6 @@
 image:
   repository: docker.elastic.co/beats/filebeat
-  tag: 6.2.2
+  tag: 6.2.3
   pullPolicy: IfNotPresent
 
 config:
@@ -22,10 +22,17 @@ config:
   - type: log
     enabled: true
     paths:
-    - /var/log/**
-    exclude_files:
-    - '(\.[0-9]{1,})$'
-    - templates/clusterrolebinding.yaml'.gz$'
+    - /var/log/*.log
+  - type: docker
+    containers.ids:
+    - "*"
+    processors:
+    - add_kubernetes_metadata:
+        in_cluster: true
+    - drop_event:
+        when:
+          equals:
+            kubernetes.container.name: "filebeat"
 
   output.file:
     path: "/usr/share/filebeat/data"