# Vector topology: OTLP and file sources, remap transforms, two sinks.
# Components are wired by naming their inputs, so the graph is implicit.

[sources.otlp_logs]
type = "opentelemetry"
grpc.address = "0.0.0.0:4317"
http.address = "0.0.0.0:4318"

[sources.container_logs]
type = "file"
include = ["/var/log/containers/*shop*.log"]
read_from = "end"
fingerprint.strategy = "checksum"

[transforms.parse_cri]
type = "remap"
inputs = ["container_logs"]
source = '''
. |= parse_regex!(.message, r'^(?P<ts>\S+) (?P<stream>stdout|stderr) (?P<tag>[FP]) (?P<body>.*)$')
.timestamp = parse_timestamp!(.ts, format: "%+")
'''

[transforms.parse_json]
type = "remap"
inputs = ["parse_cri", "otlp_logs"]
drop_on_error = false
reroute_dropped = true
source = '''
parsed, err = parse_json(.body)
if err == null {
  . = merge(., object!(parsed))
}
.level = downcase(string!(.level || "info"))
'''

[transforms.redact]
type = "remap"
inputs = ["parse_json"]
source = '''
if exists(.customer_id) { .customer_id = sha2(string!(.customer_id), variant: "SHA-256") }
del(.session_id)
del(.device_id)
'''

[sinks.http_logs]
type = "http"
inputs = ["redact"]
uri = "https://logs.example.com/v1/logs"
encoding.codec = "json"
batch.max_events = 1000
request.retry_attempts = 5

[sinks.dropped]
type = "blackhole"
inputs = ["parse_json.dropped"]
print_interval_secs = 60
