apiVersion: v1
kind: ConfigMap
metadata:
  name: logstash-{{ template "wireshark.fullname" . }}-pipeline
data:
  wireshark.conf: |
    input {
      redis {
        host => "localhost"
        key => "wireshark"
        data_type => "list"
        codec => json
        batch_count => {{  .Values.logstashConfig.batchCount }}
        threads => {{  .Values.logstashConfig.threads }}
      }
    }

    filter {
      # Drop Elasticsearch Bulk API control lines
      if ([message] =~ "{\"index") {
        drop {}
      }

      json {
        source => "message"
        remove_field => "message"
      }
      
      # Extract innermost network protocol
      grok {
        match => {
            "[layers][frame][frame_frame_protocols]" => "%{WORD:protocol}$"
        }
      }

      date {
        match => [ "timestamp", "UNIX_MS" ]
      }
    }

    output {
      elasticsearch {
        hosts => "data-service:9200"
        manage_template => false
        index => "wireshark-%{+YYYY.MM.dd}"
        document_type => "pcap_file"
        codec => json
        #user => logstash_internal
        #password => changeme
      }
    }
