# Filebeat: container logs + our own systemd units -> Elasticsearch.
# Autodiscover picks up every container, and add_docker_metadata brings the vanguard.service /
# vanguard.category labels with it (Beats turn the dots into underscores), so filtering by category in Kibana
# needs no parsing. See LOGGING.md for what each service's lines look like.

filebeat.autodiscover:
  providers:
    - type: docker
      hints.enabled: false
      templates:
        - condition: ~                      # every container
          config:
            - type: container
              paths: ["/var/lib/docker/containers/${data.docker.container.id}/*.log"]

filebeat.inputs:
  - type: journald
    id: vanguard-units
    include_matches:
      match:
        - "_SYSTEMD_UNIT=dumpd.service"
        - "_SYSTEMD_UNIT=normalize-sweep.service"
        - "_SYSTEMD_UNIT=trash-purge.service"
        - "_SYSTEMD_UNIT=vgdeband.service"
        - "_SYSTEMD_UNIT=vanguard-deadman.service"

processors:
  - add_docker_metadata: ~
  - add_host_metadata: ~
  # promote our labels to real fields so Kibana filters on service.name and vanguard.category
  - copy_fields:
      fields:
        - from: container.labels.vanguard_service
          to: service.name
        - from: container.labels.vanguard_category
          to: vanguard.category
      fail_on_error: false
      ignore_missing: true
  - drop_fields:
      fields: ["agent.ephemeral_id", "ecs.version", "input.type", "log.offset"]
      ignore_missing: true

output.elasticsearch:
  hosts: ["http://elasticsearch:9200"]

setup.kibana:
  host: "http://kibana:5601"
setup.ilm.enabled: true                     # retention: set the delete phase once in Kibana (README 5h)

logging.level: info