6952-kubernetes.conf

# SOF-ELK® Configuration File
# (C)2023 Lewes Technology Consulting, LLC
#
# This file parses timestamp+KV Kubernetes logs

filter {
  if [type] == "kubernetes" {

    if ( "k8s_json" in [tags] )  {

      date {
        match => [ "[k8s][requestReceivedTimestamp]", "ISO8601" ]
      }

      mutate {
        rename => {
          "[k8s][sourceIPs]" => "source_ip"
          "[k8s][verb]" => "method"
          "[k8s][requestURI]" => "request"
          "[k8s][userAgent]" => "useragent"
          "[k8s][responseStatus][code]" => "response_code"
        }
        uppercase => [ "method"]
      }

    } else {
      # pull client IP and optional port apart.
      if [k8s][client] {
        grok {
          patterns_dir => [ "/usr/local/sof-elk/grok-patterns" ]
          match => {
            "[k8s][client]" => [ "\[?%{IP:client_ip}\]?(?::%{INT:client_port})?" ]
          }
        }
      }

      # rename remaining desired subfields from the k8s[] array to the root
      # anything not renamed will remain in k8s.* so this is mainly helpful for common fields across data types
      mutate {
        rename => {
          "[k8s][accesskeyid]" => "accesskeyid"
          "[k8s][accountid]" => "accountid"
          "[k8s][arn]" => "arn"
          "[k8s][userid]" => "userid"
          "[k8s][username]" => "username"
        }
      }

      # split "groups" into an array if it exists but if it's an empty "[]", drop it
      if [k8s][groups] == "[]" {
        mutate {
          remove_field => [ "groups" ]
        }
      } else if [k8s][groups] {
        mutate {
          gsub => [ "[k8s][groups]", "[\[\]]", "" ]
          split => { "[k8s][groups]" => " " }
        }
      }

      # # remove the raw[] array and anything left in it
      # mutate {
      #   remove_field => [ "raw" ]
      # }
    }
  }
}