apiVersion: v1
kind: ConfigMap
metadata:
  name: fluent-bit-config
  namespace: graylog
  labels:
    k8s-app: fluent-bit
data:
  # Configuration files: server, input, filters and output
  # ======================================================
  fluent-bit.conf: |
    [SERVICE]
        Flush         1
        Log_Level     info
        Daemon        off
        Parsers_File  parsers.conf
        HTTP_Server   On
        HTTP_Listen   0.0.0.0
        HTTP_Port     2020
 
    @INCLUDE input-kubernetes.conf
    @INCLUDE filter-kubernetes.conf
    @INCLUDE output-graylog.conf
 
  input-kubernetes.conf: |
    [INPUT]
        Name              tail
        Tag               kube.*
        Path              /var/log/containers/*.log
        Parser            docker
        DB                /var/log/flb_kube.db
        Mem_Buf_Limit     5MB
        Refresh_Interval  10
        Docker_Mode       On
        Docker_Mode_Parser first_line
        Skip_Long_Lines  On
        # Multiline On
        Multiline_Flush 5
        # Parser_Firstline first_line

        # Multiline         On
        # Multiline_Flush 5
        # Parser_Firstline  log_date
        # Parser_1          log_attributes
 
  filter-kubernetes.conf: |
    [FILTER]
        Name                kubernetes
        Match               kube.*
        Kube_URL            https://kubernetes.default.svc.cluster.local:443
        Merge_Log           On
        Merge_Log_Trim      On     
        Merge_Log_Key       hello   
        K8S-Logging.Parser  On
        Keep_Log            On

    # ${HOSTNAME} returns the host name.
    # But Fluentbit runs in a container. So, it is not meaningful.
    # Instead, copy the host name from the Kubernetes object.
    [FILTER]
        Name nest
        Match *
        Operation lift
        Nested_under kubernetes

    # Remove offending fields, see: https://github.com/fluent/fluent-bit/issues/1291
    [FILTER]
        Name record_modifier
        Match *
        Remove_key annotations
        Remove_key labels

  output-graylog.conf: |
    [OUTPUT]
        Name          gelf
        Match         kube.*
        Host          graylog-udp
        Port          514
        Mode          udp
        Gelf_Short_Message_Key log


  parsers.conf: |
    [PARSER]
        Name        docker
        Format      json
        Time_Key    time
        Time_Format %Y-%m-%dT%H:%M:%S.%L
        Time_Keep   On
        # Command      |  Decoder | Field | Optional Action
        # =============|==================|=================
        # Decode_Field_As   escaped    log
        # Decode_Field_As   json       log   
        # Decode_Field_As escaped log do_next
        Decode_Field_As json log try_next
        # Decode_JSON_Field   message
        # Decode_Field_As   escaped_utf8    log    try_next
        # Decode_Field_As   escaped         log    try_next
        # Decode_Field_As   json            log    try_next

    [PARSER]
        Name        syslog
        Format      regex
        Regex       ^\<(?<pri>[0-9]+)\>(?<time>[^ ]* {1,2}[^ ]* [^ ]*) (?<host>[^ ]*) (?<ident>[a-zA-Z0-9_\/\.\-]*)(?:\[(?<pid>[0-9]+)\])?(?:[^\:]*\:)? *(?<message>.*)$
        Time_Key    time
        Time_Format %b %d %H:%M:%S
    [PARSER]
        Name   json
        Format json
        Time_Key time
        Time_Format %d/%b/%Y:%H:%M:%S %z
    # [PARSER]
    #     Name   multi_line
    #     Format regex
    #     Regex  [%Y-%m-%dT%H:%M:%S.%L]

    [PARSER]
        Name         log_date
        Format       regex
        Regex        .*\[\d{4}-\d{1,2}-\d{1,2}.*
    [PARSER]
        Format regex
        Name java_multiline
        Regex (?<apptime>\d{4}-\d{1,2}-\d{1,2} \d{1,2}:\d{1,2}:\d{1,2}\.\d{3})
        Time_Format %Y-%m-%d %H:%M:%S.%L
        Time_Keep true
        Time_Key apptime
    [PARSER]
        Name        log_attributes
        Format      regex
        Regex       /(?<level>[^\s]+:)(?<message>[\s\S]*)/
    [PARSER]
        Name        log_spec
        Format      regex
        Regex       ========
    [PARSER]
        Name        first_line
        Format      regex
        Regex       ^{"log":"(?!\\u0009)(?<log>\S(?:(\\")|[^"]){9}(?:(\\")|[^"])*)"