This functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.
Note that this release is a technical preview. It is still under active development and has additional limitations:
Persistence (experimental) is a breaking change from version 2.8.0 of the ECK operator and requires re-creation of existing Logstash resources.
The operator now includes support for persistence.
It creates a small (
logstash-data that maps to
/usr/share/logstash/data, typically used for storage from plugins.
The default volume can be overridden by adding a
spec.volumeClaimTemplate section named
logstash-data to add more storage, or to use a different
storageClass from the default, for example.
You can define additional
spec.volumeClaimTemplate for use with PQ, or DLQ, for example.
The current implementation does not allow resizing of volumes, even if your chosen storage class would support it. To resize a volume, delete the Logstash resource, delete and recreate (or resize) the volume, and create a new Logstash resource. Note that volume claims will not be deleted when you delete the Logstash resource, and must be deleted manually. This behavior might change in future versions of the ECK operator.
Adding Elasticsearch to plugin definitions requires the use of environment variables populated by the Logstash operator, which may change in future versions of the Logstash operator.
Not all Logstash plugins are supported for this technical preview. Note that this is not an exhaustive list, and plugins outside of the Logstash plugin matrix have not been considered for this list.
These plugins have been tested and are supported:
Most filter and output plugins are supported, with some exceptions noted in the next section.
Plugins not supported at technical preview
These plugins are not supported:
Plugins that may require additional manual work
Other Logstash filter and output plugins work, but require additional manual steps to mount volumes for certain configurations. For example, logstash-output-s3 requires mounting a volume to store in-progress work to avoid data loss.