apiVersion: v1
data:
  fluent.conf: |
    <source>
      @type systemd
      <storage>
        @type local
        path /var/log/journald.pos
      </storage>
      tag journald
    </source>
    <source>
      @type tail
      format json
      path /var/log/openshift-audit/*
      pos_file /var/log/openshift-audit.pos
      refresh_interval 10
      tag audit
      time_key timestamp
      time_format %Y-%m-%dT%H:%M:%SZ
    </source>
    <match logs>
      @type rewrite_tag_filter
      <rule>
        key MESSAGE
        pattern audit\.k8s\.io
        tag audit
      </rule>
      <rule>
        key MESSAGE
        pattern .+
        tag journald
      </rule>
    </match>
    <filter journald>
      @type record_transformer
      enable_ruby true
      <record>
        MESSAGE ${record["MESSAGE"].nil? ? nil : record["MESSAGE"].force_encoding("UTF-8").encode("ASCII", invalid: :replace, undef: :replace)}
        # data format:
        # k8s_apiserver_apiserver-vqxg4_kube-service-catalog_72ce4d73-5224-11e9-98d0-000d3a196756_0
        CONTAINER ${record["CONTAINER_NAME"].nil? ? nil : record["CONTAINER_NAME"].split("_")[1] }
        POD ${record["CONTAINER_NAME"].nil? ? nil : record["CONTAINER_NAME"].split("_")[2] }
        NAMESPACE ${record["CONTAINER_NAME"].nil? ? nil : record["CONTAINER_NAME"].split("_")[3] }
        CONTAINER_ID ${record["CONTAINER_NAME"].nil? ? nil : record["CONTAINER_NAME"].split("_")[4] }
      </record>
    </filter>
    <match **>
      @type mdsd
      acktimeoutms 0
      buffer_type memory
      buffer_queue_full_action block
      disable_retry_limit true
      djsonsocket /var/run/mdsd/default_djson.socket
      emit_timestamp_name time
      flush_interval 10s
    </match>
kind: ConfigMap
metadata:
  name: fluentd-config
  namespace: openshift-azure-logging
