apiVersion: v1
kind: ConfigMap
metadata:
  name: logstash-{{ template "suricata.fullname" . }}-config
apiVersion: v1
data:
  jvm.options: |
    ## JVM configuration
    # Xms represents the initial size of total heap space
    # Xmx represents the maximum size of total heap space

    -Xms{{  .Values.logstashConfig.initialJvmHeap }}
    -Xmx{{  .Values.logstashConfig.maxJvmHeap }}

    ################################################################
    ## Expert settings
    ################################################################
    ##
    ## All settings below this section are considered
    ## expert settings. Don't tamper with them unless
    ## you understand what you are doing
    ##
    ################################################################

    ## GC configuration
    -XX:+UseParNewGC
    -XX:+UseConcMarkSweepGC
    -XX:CMSInitiatingOccupancyFraction=75
    -XX:+UseCMSInitiatingOccupancyOnly

    ## optimizations

    # disable calls to System#gc
    -XX:+DisableExplicitGC

    ## Locale
    # Set the locale language
    #-Duser.language=en

    # Set the locale country
    #-Duser.country=US

    # Set the locale variant, if any
    #-Duser.variant=

    ## basic

    # set the I/O temp directory
    #-Djava.io.tmpdir=$HOME

    # set to headless, just in case
    -Djava.awt.headless=true

    # ensure UTF-8 encoding by default (e.g. filenames)
    -Dfile.encoding=UTF-8

    # use our provided JNA always versus the system one
    #-Djna.nosys=true

    # Turn on JRuby invokedynamic
    # -Djruby.compile.invokedynamic=true

    ## heap dumps

    # generate a heap dump when an allocation from the Java heap fails
    # heap dumps are created in the working directory of the JVM
    -XX:+HeapDumpOnOutOfMemoryError

    # specify an alternative path for heap dumps
    # ensure the directory exists and has sufficient space
    #-XX:HeapDumpPath=${LOGSTASH_HOME}/heapdump.hprof

    ## GC logging
    #-XX:+PrintGCDetails
    #-XX:+PrintGCTimeStamps
    #-XX:+PrintGCDateStamps
    #-XX:+PrintClassHistogram
    #-XX:+PrintTenuringDistribution
    #-XX:+PrintGCApplicationStoppedTime

    # log GC status to a file with time stamps
    # ensure the directory exists
    #-Xloggc:${LS_GC_LOG_FILE}

    # Entropy source for randomness
    -Djava.security.egd=file:/dev/urandom
  log4j2.properties : |
    status = error
    name = LogstashPropertiesConfig

    appender.console.type = Console
    appender.console.name = plain_console
    appender.console.layout.type = PatternLayout
    appender.console.layout.pattern = [%d{ISO8601}][%-5p][%-25c] %m%n

    appender.json_console.type = Console
    appender.json_console.name = json_console
    appender.json_console.layout.type = JSONLayout
    appender.json_console.layout.compact = true
    appender.json_console.layout.eventEol = true

    rootLogger.level = ${sys:ls.log.level}
    rootLogger.appenderRef.console.ref = ${sys:ls.log.format}_console
  logstash.yml : |
    http.host: "0.0.0.0"
    path.config: /usr/share/logstash/pipeline
    xpack.monitoring.enabled: true
    xpack.monitoring.elasticsearch.url: http://elasticsearch:9200
    xpack.monitoring.elasticsearch.username: logstash_system
    xpack.monitoring.elasticsearch.password: changeme
  pipelines.yml : |
    # List of pipelines to be loaded by Logstash
    #
    # This document must be a list of dictionaries/hashes, where the keys/values are pipeline settings.
    # Default values for ommitted settings are read from the `logstash.yml` file.
    # When declaring multiple pipelines, each MUST have its own `pipeline.id`.
    #
    # Example of two pipelines:
    #
    # - pipeline.id: test
    #   pipeline.workers: 1
    #   pipeline.batch.size: 1
    #   config.string: "input { generator {} } filter { sleep { time => 1 } } output { stdout { codec => dots } }"
    # - pipeline.id: another_test
    #   queue.type: persisted
    #   path.config: "/tmp/logstash/*.config"
    #
    # Available options:
    #
    #   # name of the pipeline
    #   pipeline.id: mylogs
    #
    #   # The configuration string to be used by this pipeline
    #   config.string: "input { generator {} } filter { sleep { time => 1 } } output { stdout { codec => dots } }"
    #
    #   # The path from where to read the configuration text
    #   path.config: "/etc/conf.d/logstash/myconfig.cfg"
    #
    #   # How many worker threads execute the Filters+Outputs stage of the pipeline
    #   pipeline.workers: 1 (actually defaults to number of CPUs)
    pipeline.workers: {{  .Values.logstashConfig.pipelineWorkers }}
    #
    #   # How many events to retrieve from inputs before sending to filters+workers
    pipeline.batch.size: {{  .Values.logstashConfig.pipelineWorkers }}
    #
    #   # How long to wait before dispatching an undersized batch to filters+workers
    #   pipeline.batch.delay: 5
    #
    #   # How many workers should be used per output plugin instance
    pipeline.output.workers:  {{  .Values.logstashConfig.pipelineOutputWorkers }}
    #
    #   # Internal queuing model, "memory" for legacy in-memory based queuing and
    #   # "persisted" for disk-based acked queueing. Defaults is memory
    #   queue.type: memory
    #
    #   # If using queue.type: persisted, the page data files size. The queue data consists of
    #   # append-only data files separated into pages. Default is 250mb
    #   queue.page_capacity: 250mb
    #
    #   # If using queue.type: persisted, the maximum number of unread events in the queue.
    #   # Default is 0 (unlimited)
    #   queue.max_events: 0
    #
    #   # If using queue.type: persisted, the total capacity of the queue in number of bytes.
    #   # Default is 1024mb or 1gb
    #   queue.max_bytes: 1024mb
    #
    #   # If using queue.type: persisted, the maximum number of acked events before forcing a checkpoint
    #   # Default is 1024, 0 for unlimited
    #   queue.checkpoint.acks: 1024
    #
    #   # If using queue.type: persisted, the maximum number of written events before forcing a checkpoint
    #   # Default is 1024, 0 for unlimited
    #   queue.checkpoint.writes: 1024
    #
    #   # If using queue.type: persisted, the interval in milliseconds when a checkpoint is forced on the head page
    #   # Default is 1000, 0 for no periodic checkpoint.
    #   queue.checkpoint.interval: 1000
    #
    #   # Enable Dead Letter Queueing for this pipeline.
    #   dead_letter_queue.enable: false
    #
    #   If using dead_letter_queue.enable: true, the maximum size of dead letter queue for this pipeline. Entries
    #   will be dropped if they would increase the size of the dead letter queue beyond this setting.
    #   Default is 1024mb
    #   dead_letter_queue.max_bytes: 1024mb
    #
    #   If using dead_letter_queue.enable: true, the directory path where the data files will be stored.
    #   Default is path.data/dead_letter_queue
    #
    #   path.dead_letter_queue:
  startup.options : |
    ################################################################################
    # These settings are ONLY used by $LS_HOME/bin/system-install to create a custom
    # startup script for Logstash and is not used by Logstash itself. It should
    # automagically use the init system (systemd, upstart, sysv, etc.) that your
    # Linux distribution uses.
    #
    # After changing anything here, you need to re-run $LS_HOME/bin/system-install
    # as root to push the changes to the init script.
    ################################################################################

    # Override Java location
    #JAVACMD=/usr/bin/java

    # Set a home directory
    LS_HOME=/usr/share/logstash

    # logstash settings directory, the path which contains logstash.yml
    LS_SETTINGS_DIR="${LS_HOME}/config"

    # Arguments to pass to logstash
    LS_OPTS="--path.settings ${LS_SETTINGS_DIR}"

    # Arguments to pass to java
    LS_JAVA_OPTS=""

    # pidfiles aren't used the same way for upstart and systemd; this is for sysv users.
    LS_PIDFILE=/var/run/logstash.pid

    # user and group id to be invoked as
    LS_USER=logstash
    LS_GROUP=logstash

    # Enable GC logging by uncommenting the appropriate lines in the GC logging
    # section in jvm.options
    LS_GC_LOG_FILE=/var/log/logstash/gc.log

    # Open file limit
    LS_OPEN_FILES=16384

    # Nice level
    LS_NICE=19

    # Change these to have the init script named and described differently
    # This is useful when running multiple instances of Logstash on the same
    # physical box or vm
    SERVICE_NAME="logstash"
    SERVICE_DESCRIPTION="logstash"

    # If you need to run a command or script before launching Logstash, put it
    # between the lines beginning with `read` and `EOM`, and uncomment those lines.
    ###
    ## read -r -d '' PRESTART << EOM
    ## EOM
