go-stash

gostash -f etc/config.yaml

Clusters:
- Input:
    Kafka:
      Name: gostash
      Brokers:
        - "172.16.186.16:19092"
        - "172.16.186.17:19092"
      Topics:
        - k8slog
      Group: pro
      Consumers: 16
  Filters:
    - Action: drop
      Conditions:
        - Key: k8s_container_name
          Value: "-rpc"
          Type: contains
        - Key: level
          Value: info
          Type: match
          Op: and
    - Action: remove_field
      Fields:
        - message
        - _source
        - _type
        - _score
        - _id
        - "@version"
        - topic
        - index
        - beat
        - docker_container
    - Action: transfer
      Field: message
      Target: data
  Output:
    ElasticSearch:
      Hosts:
        - "172.16.141.4:9200"
        - "172.16.141.5:9200"
      # {.event} is the value of the json attribute from input
      # {{yyyy-MM-dd}} means date, like 2020-09-09
      Index: {.event}-{{yyyy-MM-dd}}