---
apiVersion: v1
kind: ConfigMap
metadata:
  name: elk-indexer
data:
  11-input-rabbitmq: |-
    input {
            rabbitmq {
              tags => ["_indexed"]
              exclusive => false
              host => "{{rabbitmq_host}}"
              password => "{{rabbitmq_password}}"
              user => "{{rabbitmq_user}}"
              vhost => "{{rabbitmq_vhost}}"
              ack => {{rabbitmq_ack}}
              auto_delete => false
              durable => true
              exchange => "logs"
              key => "logstash.logs"
              #default 256
              prefetch_count =>  100
              queue => "logstash.logs"
              threads => 2
            }
        }

  20-filter-kubernetes: |-
    filter {
    if "kubernetes" in [tags] {
       json {
           source => 'message'
           target => 'log'
        }
        date {
          match => [ "[log][time]", "ISO8601", "dd/MMM/YYYY:HH:mm:ss Z", "dd/MMM/YYYY/HH/mm/ss" ]
        }
        mutate {
         rename => ["[log][log]", "message"]
        }
        mutate {
          remove_field => ["[log][time]"]
        }
       }
     }

  21-filter-json-message: |-
    filter {
      if [kubernetes][container_name] in [{{json_containers}}] {
        json {
         source => 'message'
         target => 'data'
        }
       }
      }

  90-output-elasticsearch: |-
    output {
      elasticsearch {
        hosts => [{{elasticsearch_hosts}}]
    }
    }
