# Fluent Bit pipeline: read CRI container logs, parse the JSON body,
# enrich with Kubernetes metadata, then forward.
[SERVICE]
    Flush            5
    Daemon           Off
    Log_Level        info
    Parsers_File     parsers.conf
    HTTP_Server      On
    HTTP_Listen      0.0.0.0
    HTTP_Port        2020
    storage.path     /var/log/flb-storage/
    storage.sync     normal
    storage.backlog.mem_limit 64M

[INPUT]
    Name             tail
    Tag              kube.*
    Path             /var/log/containers/*shop*.log
    multiline.parser cri
    Mem_Buf_Limit    32MB
    Skip_Long_Lines  On
    Refresh_Interval 10
    DB               /var/log/flb-tail.db

[FILTER]
    Name             kubernetes
    Match            kube.*
    Kube_Tag_Prefix  kube.var.log.containers.
    Merge_Log        On
    Merge_Log_Key    app
    Keep_Log         Off
    K8S-Logging.Parser On

[FILTER]
    Name             modify
    Match            kube.*
    Remove           app.session_id
    Remove           app.device_id
    Rename           app.msg message

[FILTER]
    Name             throttle
    Match            kube.*
    Rate             2000
    Window           5
    Interval         1s

[OUTPUT]
    Name             http
    Match            kube.*
    Host             logs.example.com
    Port             443
    URI              /v1/logs
    Format           json_lines
    tls              On
    Retry_Limit      5