---
# Source: sumologic/templates/logs/collector/otelcol/configmap.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: RELEASE-NAME-sumologic-otelcol-logs-collector
  labels:
    app: RELEASE-NAME-sumologic-otelcol-logs-collector
    chart: "sumologic-%CURRENT_CHART_VERSION%"
    release: "RELEASE-NAME"
    heritage: "Helm"
data:
  config.yaml: |
    
    exporters:
      otlphttp:
        endpoint: http://${LOGS_METADATA_SVC}.${NAMESPACE}.svc.cluster.local:4318
    extensions:
      file_storage:
        directory: /var/lib/storage/otc
        timeout: 10s
      health_check: {}
      pprof: {}
    processors:
      batch:
        send_batch_size: 10240
        timeout: 1s
    receivers:
      filelog/containers:
        include:
        - /var/log/pods/*/*/*.log
        include_file_name: false
        include_file_path: true
        operators:
        - id: get-format
          routes:
          - expr: $$body matches "^\\{"
            output: parser-docker
          - expr: $$body matches "^[^ Z]+ "
            output: parser-crio
          - expr: $$body matches "^[^ Z]+Z"
            output: parser-containerd
          type: router
        - id: parser-crio
          output: merge-cri-lines
          regex: ^(?P<time>[^ Z]+) (?P<stream>stdout|stderr) (?P<logtag>[^ ]*) (?P<log>.*)$
          timestamp:
            layout: "2006-01-02T15:04:05.000000000-07:00"
            layout_type: gotime
            parse_from: time
          type: regex_parser
        - id: parser-containerd
          output: merge-cri-lines
          regex: ^(?P<time>[^ ^Z]+Z) (?P<stream>stdout|stderr) (?P<logtag>[^ ]*) (?P<log>.*)$
          timestamp:
            layout: '%Y-%m-%dT%H:%M:%S.%LZ'
            parse_from: time
          type: regex_parser
        - id: parser-docker
          output: merge-docker-lines
          timestamp:
            layout: '%Y-%m-%dT%H:%M:%S.%LZ'
            parse_from: time
          type: json_parser
        - combine_field: log
          id: merge-docker-lines
          is_last_entry: $$body.log matches "\n$"
          output: extract-metadata-from-filepath
          type: recombine
        - combine_field: log
          combine_with: ""
          id: merge-cri-lines
          is_last_entry: $$body.logtag == "F"
          output: extract-metadata-from-filepath
          overwrite_with: newest
          type: recombine
        - id: extract-metadata-from-filepath
          parse_from: $$attributes["file.path"]
          regex: ^.*\/(?P<namespace>[^_]+)_(?P<pod_name>[^_]+)_(?P<uid>[a-f0-9\-]+)\/(?P<container_name>[^\._]+)\/(?P<run_id>\d+)\.log$
          type: regex_parser
        - attributes:
            k8s.container.name: EXPR($.container_name)
            k8s.namespace.name: EXPR($.namespace)
            k8s.pod.name: EXPR($.pod_name)
            k8s.pod.uid: EXPR($.uid)
            run_id: EXPR($.run_id)
            stream: EXPR($.stream)
          id: copy-attributes
          type: metadata
        - id: clean-up-log-body
          ops:
          - move:
              from: log
              to: $
          type: restructure
        start_at: beginning
    service:
      extensions:
      - health_check
      - file_storage
      - pprof
      pipelines:
        logs/containers:
          exporters:
          - otlphttp
          processors:
          - batch
          receivers:
          - filelog/containers
      telemetry:
        logs:
          level: info
