apiVersion: v1
kind: ConfigMap
metadata:
  name: fluent-bit-config
  namespace: vmware-system
  labels:
    k8s-app: fluent-bit
data:
  fluent-bit.conf: |
    [SERVICE]
        Flush         1
        Log_Level     info
        Daemon        off
        Parsers_File  parsers.conf
        HTTP_Server   On
        HTTP_Listen   0.0.0.0
        HTTP_Port     2020

    @INCLUDE input-kubernetes.conf
    @INCLUDE filter-kubernetes.conf
    @INCLUDE filter-record.conf
    @INCLUDE output-syslog.conf

  input-kubernetes.conf: |
    [INPUT]
        Name                tail
        Tag                 kube.*
        Path                /var/log/containers/*.log
        Parser              docker
        DB                  /var/log/flb_kube.db
        Mem_Buf_Limit       10MB
        Skip_Long_Lines     On
        Refresh_Interval    10

  filter-kubernetes.conf: |
    [FILTER]
        Name                kubernetes
        Match               kube.*
        Kube_URL            https://kubernetes.default.svc:443
        Kube_CA_File        /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
        Kube_Token_File     /var/run/secrets/kubernetes.io/serviceaccount/token
        Kube_Tag_Prefix     kube.var.log.containers.
        Merge_Log           On
        Merge_Log_Key       log_processed
        K8S-Logging.Parser  On
        K8S-Logging.Exclude Off

    [FILTER]
        Name                modify
        Match               kube.*
        Copy                kubernetes k8s

    [FILTER]
        Name                nest
        Match               kube.*
        Operation           lift
        Nested_Under        kubernetes

  filter-record.conf: |
    [FILTER]
        Name                 record_modifier
        Match                *
        Record veba_instance ${HOSTNAME}
        Record veba_cluster  ${HOSTNAME}

    [FILTER]
        Name                nest
        Match               kube.*
        Operation           nest
        Wildcard            veba_instance*
        Nest_Under          veba

  output-syslog.conf: |
    [OUTPUT]
        Name                 syslog
        Match                *
        Host                 ${SYSLOG_SERVER_HOSTNAME}
        Port                 ${SYSLOG_SERVER_PORT}
        Mode                 ${SYSLOG_SERVER_PROTOCOL}
        Syslog_Format        ${SYSLOG_SERVER_FORMAT}
        Syslog_Hostname_key  veba_cluster
        Syslog_Appname_key   pod_name
        Syslog_Procid_key    container_name
        Syslog_Message_key   message
        syslog_msgid_key     msgid
        Syslog_SD_key        k8s
        Syslog_SD_key        labels
        Syslog_SD_key        annotations
        Syslog_SD_key        veba

  parsers.conf: |
    [PARSER]
        Name                 json
        Format               json
        Time_Key             time
        Time_Format          %d/%b/%Y:%H:%M:%S %z

    [PARSER]
        Name                 docker
        Format               json
        Time_Key             time
        Time_Format          %Y-%m-%dT%H:%M:%S.%L
        Time_Keep            On

    [PARSER]
        Name                 cri
        Format               regex
        Regex                ^(?<time>[^ ]+) (?<stream>stdout|stderr) (?<logtag>[^ ]*) (?<message>.*)$
        Time_Key             time
        Time_Format          %Y-%m-%dT%H:%M:%S.%L%z

    [PARSER]
        Name                 syslog
        Format               regex
        Regex                ^\<(?<pri>[0-9]{1,5})\>1 (?<time>[^ ]+) (?<host>[^ ]+) (?<ident>[^ ]+) (?<pid>[-0-9]+) (?<msgid>[^ ]+) (?<extradata>(\[(.*)\]|-)) (?<message>.+)$
        Time_Key             time
        Time_Format          %Y-%m-%dT%H:%M:%S.%L
        Time_Keep            On