# Vector pipeline that collects logs and sends them to ElasticSearch
[sources.redis_logs_from_file]
    type = "file"
    include = [
        "/var/log/redis/redis-server.log",
    ]

# Parse data
[transforms.parse_redis_logs]
	type = "remap"
	inputs = [
        "redis_logs_from_file"
    ]
	source = '''
	    source_file = .file

        parsed, err = parse_regex(.message, r'[^ ](?P<timestamp>\s\d{2} \S* \d{4} \d{2}:\d{2}:\d{2}.\d*) (?P<message>.*)')
        message = replace(.message, parsed.timestamp, "") ?? ""

        if err != null {
            abort
        }

        . = {}
        .timestamp = now()
        .message = message
        .file = source_file
    '''


[sinks.redis_logs_to_es]
    type = "elasticsearch"
    inputs   = ["parse_redis_logs"]
    compression = "none"
    healthcheck = true
    auth.strategy= "basic"
    auth.user = "{{ elastic_login }}"
    auth.password = "{{ elastic_password }}"
    endpoint = "{{ elastic_url }}"
    normal.index = "system-logs"
    id_key = "event_uuid"