Metricbeat for monitoring Openshift Horizontal Pod Autoscaler

Elastic Stack Beats
2

i decided to use a logstash to get the HPA data using http_poller plugin since i can't get any answer.

if anyone stumbled into my post and looking for the solution. here is my configuration

input {
	http_poller {
		urls => {
			cluster_url => { 
				url => 'https://your-kube-state-metric:<yourKSMport>/metrics'
				method => "GET"
                                ssl => true
                                cacert => "/your/path/to/ca.crt"
                                client_cert => "/your/path/to/ca.crt"
                                client_key => "/your/path/to/ca.key"
                                ssl_truststore_path => "/your/path/to/keystore.jks"
                                ssl_truststore_password => "yourtruststorepassword"
                                ssl_certificate_verification => true
                                headers => {
                                       Accept => "text/plain"
				    }
				}
			}
	codec => plain
	schedule => { every => "10s" }
 }
}

# split the message so logstash can parse properly for each line
filter {
  split {
    field => "message"
  }

# this grok only match for the HPA information exposed by KSM
  grok {
    match => {
      "message" => [
        'kube_horizontalpodautoscaler_status_desired_replicas{namespace="%{DATA:namespace}",horizontalpodautoscaler="%{DATA:hpa_name}"}\s+%{NUMBER:desired_replica}',
        'kube_horizontalpodautoscaler_status_current_replicas{namespace="%{DATA:namespace}",horizontalpodautoscaler="%{DATA:hpa_name}"}\s+%{NUMBER:current_replica}',
        'kube_horizontalpodautoscaler_spec_max_replicas{namespace="%{DATA:namespace}",horizontalpodautoscaler="%{DATA:hpa_name}"}\s+%{NUMBER:max_replica}',
        'kube_horizontalpodautoscaler_spec_min_replicas{namespace="%{DATA:namespace}",horizontalpodautoscaler="%{DATA:hpa_name}"}\s+%{NUMBER:min_replica}'
      ]
    }
  }

# drop everything else other than HPA to reduce index size
  if "_grokparsefailure" in [tags] {
    drop { }
  }

# change the field name for readability
  mutate {
    rename => {
      "namespace" => "kubernetes.namespace"
      "hpa_name" => "kubernetes.hpa_name"
      "desired_replica" => "kubernetes.hpa.replicas.desired_replica"
      "current_replica" => "kubernetes.hpa.replicas.current_replica"
      "max_replica" => "kubernetes.hpa.replicas.max_replica"
      "min_replica" => "kubernetes.hpa.replicas.min_replica"
    }

# convert the field into integer type and delete the original message, it can be endless and goint to take a lot of storage
   convert => {
      "kubernetes.hpa.replicas.desired_replica" => "integer"
      "kubernetes.hpa.replicas.current_replica" => "integer"
      "kubernetes.hpa.replicas.max_replica" => "integer"
      "kubernetes.hpa.replicas.min_replica" => "integer"
    }
  remove_field => ["message", "[event][original]"]
  }
 
}

logstash require you to recognize the certificate so you need to add the truststore in the jvm.option

-Djavax.net.ssl.trustStore=/your/path/to/truststore.jks
-Djavax.net.ssl.trustStorePassword=yourtruststorepassword

if anyone has more optimized way to get the data, feel free to reply this post

cheers!