apiVersion: v1
kind: ConfigMap
metadata:
  name: logstash-pipeline
  labels:
    app: logstash
    chart: logstash-2.4.1
    heritage: Helm
data:
  logstash.conf: |-
    input {
      http {
        port => 5044
        add_field => { "[@metadata][input-http]" => "" }
      }
    }

    filter {
      if [@metadata][input-http] {
        date {
          match => [ "date", "UNIX" ]
          remove_field => [ "date" ]
        }
        mutate {
          remove_field => ["headers","host"]
        }
      }

      if [message] =~ "\A\{.+\}\z" {
        json{
          source => "message"
          skip_on_invalid_json => false
        }

        mutate {
          remove_field => ["log", "cloud", "ecs", "agent", "input", "tags", "docker", "container", "host", "message", "@version"]
          remove_field => ["headers","host"]
        }
      }
    }

    output {
      elasticsearch {
        hosts => ["elasticsearch-master:9200"]
        manage_template => false
        index => "fluent-bit-%{+YYYY.MM.dd}-NAMESPACE"
        user => "REP_ES_USER"
        password => "REP_ES_PASS"
      }
    }