apiVersion: v1
kind: ConfigMap
metadata:
  name: logstash-{{ template "syslog.fullname" . }}-pipeline
data:
  syslog.conf: |
    input {
      tcp {
        port => 5144
        type => syslog
      }
      udp {
        port => 5144
        type => syslog
      }
    }

    filter {
        grok {
          match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" }
          add_field => [ "received_at", "%{@timestamp}" ]
          add_field => [ "received_from", "%{host}" ]
        }
        date {
          match => [ "syslog_timestamp", "MMM  d HH:mm:ss", "MMM dd HH:mm:ss" ]
        }
    }
    
    output {
      stdout { codec => rubydebug }
    }

    output {
      elasticsearch {
        hosts => "data-service:9200"
        manage_template => false
        index => "syslog-%{+YYYY.MM.dd}"
        document_type => "%{[@metadata][type]}"
        codec => json
        #user => logstash_internal
        #password => changeme
      }
    }
