Filebeat k8s fix

stable/filebeat/Chart.yaml

@@ -2,8 +2,8 @@ apiVersion: v1
 description: A Helm chart to collect Kubernetes logs with filebeat
 icon: https://www.elastic.co/assets/blt47799dcdcf08438d/logo-elastic-beats-lt.svg
 name: filebeat
-version: 0.1.0
-appVersion: 6.2.2
+version: 0.1.1
+appVersion: 6.2.3
 sources:
 - https://www.elastic.co/guide/en/beats/filebeat/current/index.html
 maintainers:

stable/filebeat/templates/daemonset.yaml

@@ -43,24 +43,24 @@ spec:
           mountPath: /usr/share/filebeat/filebeat.yml
           readOnly: true
           subPath: filebeat.yml
-        - name: prospectors-config
-          mountPath: /usr/share/filebeat/prospectors.d
-          readOnly: true
         - name: data
           mountPath: /usr/share/filebeat/data
+        - name: varlog
+          mountPath: /var/log
+          readOnly: true          
         - name: varlibdockercontainers
           mountPath: /var/lib/docker/containers
           readOnly: true
       volumes:
+      - name: varlog
+        hostPath:
+          path: /var/log
       - name: varlibdockercontainers
         hostPath:
           path: /var/lib/docker/containers
       - name: filebeat-config
         secret:
           secretName: {{ template "filebeat.fullname" . }}
-      - name: prospectors-config
-        configMap:
-          name: {{ template "filebeat.fullname" . }}-prospectors
       - name: data
         hostPath:
           path: /var/lib/filebeat

stable/filebeat/values.yaml

@@ -1,6 +1,6 @@
 image:
   repository: docker.elastic.co/beats/filebeat
-  tag: 6.2.2
+  tag: 6.2.3
   pullPolicy: IfNotPresent
 
 config:
@@ -22,10 +22,17 @@ config:
   - type: log
     enabled: true
     paths:
-    - /var/log/**
-    exclude_files:
-    - '(\.[0-9]{1,})$'
-    - templates/clusterrolebinding.yaml'.gz$'
+    - /var/log/*.log
+  - type: docker
+    containers.ids:
+    - "*"
+    processors:
+    - add_kubernetes_metadata:
+        in_cluster: true
+    - drop_event:
+        when:
+          equals:
+            kubernetes.container.name: "filebeat"
 
   output.file:
     path: "/usr/share/filebeat/data"