filebeat helm chart 在配置 filebeatConfig 想配置成多配置文件模式，但是网上没有找到对应配置，单配置文件模式如下所示

yaml
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20

  filebeatConfig:
    filebeat.yml: |
      filebeat.inputs:
      - type: container
        paths:
          - /var/log/containers/*.log
        processors:
        - add_kubernetes_metadata:
            host: ${NODE_NAME}
            matchers:
            - logs_path:
                logs_path: "/var/log/containers/"

      output.elasticsearch:
        host: '${NODE_NAME}'
        hosts: '["https://${ELASTICSEARCH_HOSTS:elasticsearch-master:9200}"]'
        username: '${ELASTICSEARCH_USERNAME}'
        password: '${ELASTICSEARCH_PASSWORD}'
        protocol: https
        ssl.certificate_authorities: ["/usr/share/filebeat/certs/ca.crt"]

在网上有找到一个配置 [1] 是讲启用 filebeat module

yaml
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

  filebeatConfig:
      filebeat.yml: |
        filebeat.config:
          modules:
            enabled: true
            path: ${path.config}/module.*.yml
            reload.enabled: true        
       module.okta.yml: |
              - module: okta
                system:
                  enabled: true
                  var.url: https://yourOktaDomain/api/v1/logs
                  var.api_key: 'test'

根据这个进行配置文件进行扩展

yaml
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19

filebeatConfig:
  # filebeat.yaml 是必须的，这个是启动filebeat的配置文件
  filebeat.yml: |
    # 这里根据filebeat config的配置说明，直接使用config loading的功能
    # https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-configuration-reloading.html
    inputs:
      enabled: true
      path: module.*.yml
    output.elasticsearch:
      host: '${NODE_NAME}'    
   module.xxx.yml: |
	- type: log
      paths:
        - /var/log/mysql.log
      scan_frequency: 10s
   module.xxx.yaml: |
    - type: container
      paths: 
      - '/var/log/containers/*.log'

Reference

[1] Cannot enable Filebeat modules through values.yml

[2] Container input