apiVersion: v1
data:
  fluent.conf: |
    <source>
      @type systemd
      <storage>
        @type local
        path /var/log/journald.pos
      </storage>
      tag logs
    </source>
    <match logs>
      @type rewrite_tag_filter
      <rule>
        key MESSAGE
        pattern audit\.k8s\.io
        tag audit
      </rule>
      <rule>
        key MESSAGE
        pattern .+
        tag journald
      </rule>
    </match>
    <match **>
      @type mdsd
      djsonsocket /var/run/mdsd/default_djson.socket
      acktimeoutms 5000
      buffer_chunk_limit 1000k
      buffer_type file
      buffer_path /var/log/td-agent/buffer
      buffer_queue_limit 128
      emit_timestamp_name time
      flush_interval 10s
      retry_limit 3
      retry_wait 10s
    </match>
kind: ConfigMap
metadata:
  name: fluentd-config
  namespace: openshift-azure-logging
