# Metricbeat: host and per-container metrics, replacing node_exporter and cAdvisor, plus the Prometheus
# endpoints the stack already exposes. Runs on the host network so the system module sees the real interfaces
# and so it can reach MediaMTX, Caddy, Elasticsearch and Kibana on loopback.

metricbeat.modules:
  - module: system
    period: 30s
    metricsets: [cpu, load, memory, network, process, process_summary, socket_summary, filesystem, fsstat, diskio, uptime]
    processes: ['.*']
    process.include_top_n:
      by_cpu: 10
      by_memory: 10
    system.hostfs: /hostfs                  # the host's real filesystems, not the container's

  - module: docker
    period: 30s
    hosts: ["unix:///var/run/docker.sock"]
    metricsets: [container, cpu, diskio, healthcheck, info, memory, network]

  - module: prometheus                      # MediaMTX: per path bytes/s, readers, publishers, dropped packets
    period: 30s
    metrics_path: /metrics
    hosts: ["http://127.0.0.1:9998"]

  - module: prometheus                      # Caddy: requests by host and status, durations, TLS
    period: 60s
    metrics_path: /metrics
    hosts: ["http://127.0.0.1:2019"]

processors:
  - add_host_metadata: ~
  # The same correlation fields Filebeat sets, so ONE dashboard filter spans logs and metrics. Without these a
  # metric event carries container.name while a log event carries service.name, and nothing joins them.
  - add_docker_metadata: ~
  - copy_fields:
      fields:
        - from: container.labels.vanguard_service
          to: service.name
        - from: container.labels.vanguard_category
          to: vanguard.category
      fail_on_error: false
      ignore_missing: true

output.elasticsearch:
  hosts: ["http://127.0.0.1:9200"]

setup.kibana:
  host: "http://127.0.0.1:5601"
setup.dashboards.enabled: true              # the system and docker dashboards, so there is something to look at

logging.level: info