---
apiVersion: v1
kind: ConfigMap
metadata:
  name: splunk-kubernetes-metrics
  labels:
    app: splunk-kubernetes-metrics
    version: 1.0.0
data:
  fluent.conf: |
    # system wide configurations
    <system>
      log_level info
    </system>

    <source>
      @type udp
      tag raw.metrics.udp
      port 9001
      message_length_limit 100m
      <parse>
        @type jq
        jq 'split("\n") | reduce .[] as $item ({}; ($item | rindex(":")) as $i | .[$item[:$i]] = ($item[$i+1:-2] | tonumber))'
      </parse>
    </source>

    <match raw.metrics.udp>
      @type jq
      jq "def extract_labels:\n  . as $labels | reduce range(length) as $n ({}; if $n % 2 == 0 then .[\"label.\" + $labels[$n]] = $labels[$n + 1] else . end);\n\ndef extract_metric:\n  if length % 2 == 0\n  then (.[:-2] | extract_labels) + {metric: (.[-2] | gsub(\"/\"; \".\")), resource_id: .[-1]}\n  else (.[:-1] | extract_labels) + {metric: (.[-1] | gsub(\"/\"; \".\"))}\n  end;\n  \ndef extract_container:\n  split(\".\") | {container_type: \"pod\", node: .[1], namespace: .[3], pod: .[5], container: .[7]} + (.[8:] | extract_metric) | .metric = \"kube.container.\" + .metric | . ;\n  \ndef extract_syscontainer:\n  split(\".\") | {container_type: \"sys\", node: .[1], container: .[3]} + (.[4:] | extract_metric) | .metric = \"kube.container.\" + .metric | . ;\n  \ndef extract_pod:\n  split(\".\") | {node: .[1], namespace: .[3], pod: .[5]} + (.[6:] | extract_metric) | .metric = \"kube.pod.\" + .metric | . ;\n  \ndef extract_namespace:\n  split(\".\") | {namespace: .[1]} + (.[2:] | extract_metric) | .metric = \"kube.namespace.\" + .metric | . ;\n  \ndef extract_node:\n  split(\".\") | {node: .[1]} + (.[2:] | extract_metric) | .metric = \"kube.node.\" + .metric | . ;\n  \ndef extract_cluster:\n  split(\".\") | .[1:] | extract_metric | .metric = \"kube.cluster.\" + .metric | . ;\n\ndef extract:\n  if contains(\".container.\")\n  then extract_container\n  elif contains(\".sys-container.\")\n  then extract_syscontainer\n  elif contains(\".pod.\")\n  then extract_pod\n  elif startswith(\"namespace.\")\n  then extract_namespace\n  elif startswith(\"node.\")\n  then extract_node\n  elif startswith(\"cluster.\")\n  then extract_cluster\n  else {}\n  end;\n\n \"heapster/namespace:\\(env.MY_NAMESPACE)/pod:\\(env.MY_POD_NAME)\" as $source | .record | to_entries | map({value, source: $source} + (.key | extract)) | ."
      remove_tag_prefix raw
    </match>

    <match metrics.udp>
      @type splunk_hec
      data_type metric
      metric_name_key metric
      metric_value_key value
      protocol https
      hec_host MY-SPLUNK-HOST
      hec_port 8088
      hec_token "#{ENV['SPLUNK_HEC_TOKEN']}"
      host "#{ENV['SPLUNK_HEC_HOST']}"
      source ${tag}
      insecure_ssl true
      <buffer>
        @type memory
        chunk_limit_size 500m
        chunk_limit_records 100000
        flush_interval 5s
        flush_thread_count 1
        overflow_action block
        retry_max_times 3
      </buffer>
    </match>
