apiVersion: v1
kind: ConfigMap
metadata:
  name: infra-fluentd
  labels:
    app: fluentd
data:
  fluent.conf: |-
    <source>
      @type forward
      port 24224
      bind 0.0.0.0
    </source>

    # Prevent fluentd from handling records containing its own logs. Otherwise
    # it can lead to an infinite loop, when error in sending one message generates
    # another message which also fails to be sent and so on.
    <match fluentd.**>
      @type null
    </match>

    # Used for health checking
    <source>
      @type http
      port 9880
      bind 0.0.0.0
    </source>

    # Emits internal metrics to every minute, and also exposes them on port
    # 24220. Useful for determining if an output plugin is retryring/erroring,
    # or determining the buffer queue length.
    <source>
      @type monitor_agent
      bind 0.0.0.0
      port 24220
      tag fluentd.monitor.metrics
    </source>

    <filter slowlog.**>
      @type concat
      key log
      separator ""
      stream_identity_key docker_id
      multiline_start_regexp /^# Time/
      multiline_end_regexp /.*;\n/
    </filter>

    <match slowlog.**>
      @id elasticsearch
      @type elasticsearch
      @log_level info
      include_tag_key true
      # Replace with the host/port to your Elasticsearch cluster.
      host "#{ENV['OUTPUT_HOST']}"
      port "#{ENV['OUTPUT_PORT']}"
      scheme "#{ENV['OUTPUT_SCHEME']}"
      ssl_version "#{ENV['OUTPUT_SSL_VERSION']}"
      logstash_format true
      logstash_prefix slowlog
      <buffer>
        @type file
        path /var/log/fluentd-buffers/kubernetes.system.buffer
        flush_mode interval
        retry_type exponential_backoff
        flush_thread_count 2
        flush_interval 5s
        retry_forever
        retry_max_interval 30
        chunk_limit_size "#{ENV['OUTPUT_BUFFER_CHUNK_LIMIT']}"
        queue_limit_length "#{ENV['OUTPUT_BUFFER_QUEUE_LIMIT']}"
        overflow_action block
      </buffer>
    </match>

    <filter auditlog.**>
      @type parser
      key_name log
      reserve_data true
      <parse>
       @type regexp
       expression /^.*\[TIMESTAMP=(?<timestamp>.*)\] \[EVENT_CLASS=(?<event>.*)\] \[EVENT_SUBCLASS=.* \[COST_TIME=(?<cost_time>.*)\] \[HOST=(?<host>.*)\] \[CLIENT_IP=(?<client>.*)\] \[USER=(?<user>.*)] \[DATABASES="\[(?<db>.?*)]"] \[TABLES="\[(?<table>.?*)]"] \[SQL_TEXT="(?<sql>.?*)"] \[ROWS=(?<row>\d?*)\].*$/

       time_key timestamp
       time_type string
       time_format %Y/%m/%d %H:%M:%S.%L
      </parse>
    </filter>

    <match auditlog.**>
      @id auditlog
      @type elasticsearch
      @log_level debug
      include_tag_key true
      # Replace with the host/port to your Elasticsearch cluster.
      host "#{ENV['OUTPUT_HOST']}"
      port "#{ENV['OUTPUT_PORT']}"
      scheme "#{ENV['OUTPUT_SCHEME']}"
      ssl_version "#{ENV['OUTPUT_SSL_VERSION']}"
      logstash_format true
      logstash_prefix auditlog
      <buffer>
        @type file
        path /var/log/fluentd-buffers/auditlog
        flush_mode interval
        retry_type exponential_backoff
        flush_thread_count 2
        flush_interval 5s
        retry_forever
        retry_max_interval 30
        chunk_limit_size "#{ENV['OUTPUT_BUFFER_CHUNK_LIMIT']}"
        queue_limit_length "#{ENV['OUTPUT_BUFFER_QUEUE_LIMIT']}"
        overflow_action block
      </buffer>
    </match>

    #<match **>
    #  @type stdout
    #</match>

    <system>
      root_dir /tmp/fluentd-buffers/
      log_level debug
    </system>