# fluentd.conf
<system>
log_level info
rpc_endpoint 0.0.0.0:24444
</system>

<source>
@type tail
path /fluentd/apigateway_source/logs/server.log
tag serverlog.*
pos_file "/fluentd/log/fluentd-serverlog.pos"
<parse>
@type multiline
format_firstline /\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}/
format1 /^(?<message>.*)$/
</parse>
</source>

<source>
@type tail
path /fluentd/apigateway_source/logs/console.log
tag consolelog.*
pos_file "/fluentd/log/fluentd-consolelog.pos"
<parse>
@type multiline
format_firstline /\d{4}-\d{1,2}-\d{1,2}/
format1 /^(?<message>.*)$/
</parse>
</source>


<source>
@type tail
path /fluentd/apigateway_source/logs/APIGatewayUI.log
tag apigwuilog.*
pos_file "/fluentd/log/fluentd-apigwuilog.pos"
<parse>
@type multiline
format_firstline /\d{4}-\d{1,2}-\d{1,2}/
format1 /^(?<message>.*)$/
</parse>
</source>

<filter serverlog.**>
@type parser
key_name message
reserve_data true
<parse>
@type regexp
expression /^(?<time>[^\[]*) \[(?<logger>[^\]]*)\][^=]*=(?<thread>[^)]*)\) *(?<inner_message>.*)$/
time_format %Y-%m-%d %H:%M:%S %Z
keep_time_key true
</parse>
@log_level error
</filter>


<filter serverlog.**>
@type parser
key_name inner_message
reserve_data true
<parse>
@type multi_format
<pattern>
format /(?<=\[)[^\[]*\[(?<node>[^\]]+)\]\[[^:]+:(?<correlationId>[^\]]+):/
</pattern>
<pattern>
format /(?<=\[)[^\[]*\[(?<node>[^\]]+)\]/
</pattern>
</parse>
@log_level error
emit_invalid_record_to_error false
</filter>

<filter serverlog.**>
@type record_transformer
enable_ruby
<record>
id apigw-is
file server.log
logLevel ${record["logger"].split('').last == "I" ? "INFO" : record["logger"].split('').last == "W" ? "WARN" : record["logger"].split('').last == "E" ? "ERROR" : record["logger"].split('').last == "D" ? "DEBUG" :record["logger"].split('').last == "T" ? "TRACE" :record["logger"].split('').last == "C" ? "CRITICAL" : record["logger"].split('').last}
fileType APIGatewayServerLogs
timezone +00:00
logFilePath /opt/softwareag/IntegrationServer/logs/server.log
@timestamp ${require 'time'; Time.strptime(record["time"], "%Y-%m-%d %H:%M:%S GMT").utc.iso8601}
timestamp ${record["time"].gsub(' GMT', '+00:00')}
</record>
remove_keys inner_message
</filter>

<filter consolelog.**>
@type parser
key_name message
reserve_data true
<parse>
@type regexp
expression /^(?<time>\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2},\d{3})\s+(?<logLevel>\S+)\s+(?<inner_message>.*)$/
time_format %Y-%m-%d %H:%M:%S,%L
keep_time_key true
</parse>
</filter>


<filter consolelog.**>
@type record_transformer
enable_ruby
<record>
id apigw-is
file console.log
fileType APIGatewayConsoleLogs
timezone +00:00
node apigw01
logFilePath /opt/softwareag/IntegrationServer/logs/console.log
@timestamp ${Time.strptime(record["time"], '%Y-%m-%d %H:%M:%S,%L').utc.strftime('%Y-%m-%dT%H:%M:%SZ')}
timestamp ${Time.strptime(record["time"], '%Y-%m-%d %H:%M:%S,%L').utc.strftime('%Y-%m-%d %H:%M:%S+00:00')}
</record>
remove_keys inner_message
</filter>

<filter apigwuilog.**>
@type parser
key_name message
reserve_data true
<parse>
@type regexp
expression /^(?<time>\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2},\d{3})\s+(?<logLevel>\S+)\s+(?<inner_message>.*)$/
time_format %Y-%m-%dT%H:%M:%S,%L
keep_time_key true
</parse>
</filter>


<filter apigwuilog.**>
@type record_transformer
enable_ruby
<record>
id apigw-is
file APIGatewayUI.log
fileType APIGatewayUILogs
timezone +00:00
node apigw01
logFilePath /opt/softwareag/apigatewayui/logs/APIGatewayUI.log
@timestamp ${Time.strptime(record["time"], '%Y-%m-%dT%H:%M:%S,%L').utc.strftime('%Y-%m-%dT%H:%M:%SZ')}
timestamp ${Time.strptime(record["time"], '%Y-%m-%dT%H:%M:%S,%L').utc.strftime('%Y-%m-%d %H:%M:%S+00:00')}
</record>
remove_keys inner_message
</filter>

<match serverlog.** consolelog.** apigwuilog.**>
@type elasticsearch
hosts "#{ENV['ES_HOST']}"
index_name "#{ENV['APIGWLOGINDEX']}"
type_name _doc
flush_interval 1s
##@log_level trace
<buffer>
@type memory
flush_interval 2s
chunk_limit_size 1m
queue_limit_length 1
</buffer>
</match>

<match *.**>
@type stdout
</match>