sources:
  syslog_auth:
    type: socket
    mode: udp
    address: 0.0.0.0:4100
    decoding:
      codec: syslog
  syslog_kern:
    type: socket
    mode: udp
    address: 0.0.0.0:4101
    decoding:
      codec: syslog
  apache_log:
    type: socket
    path: /var/lib/vector/vector-apache.sock
    socket_file_mode: 0o755
    framing:
      method: "newline_delimited"
    mode: unix_datagram
    decoding:
      codec: bytes
  int_metrics:
    type: internal_metrics
  apache_error_log:
    type: socket
    path: /var/lib/vector/apache-error-log.sock
    socket_file_mode: 0o755
    framing:
      method: "newline_delimited"
    mode: unix_datagram
    decoding:
      codec: bytes
transforms:
  syslog_oom_filter:
    type: filter
    inputs:
      - syslog_kern
    condition: 'contains(string!(.message), "Memory cgroup out of memory")'
  oom_parse_remap:
    type: remap
    inputs: ['syslog_oom_filter']
    source: |-
      data, err = parse_regex(.message, r'Memory cgroup out of memory: Killed process (?P<pid>\d+) \((?P<process_name>[^)]+)\) total-vm:(?P<total_vm>\d+)kB, anon-rss:(?P<anon_rss>\d+)kB, file-rss:(?P<file_rss>\d+)kB, shmem-rss:(?P<shmem_rss>\d+)kB, UID:(?P<uid>\d+) pgtables:(?P<pgtables>\d+)kB oom_score_adj:(?P<oom_score_adj>-?\d+)')
  apache_remap:
    type: remap
    inputs: ['apache_log']
    source: |-
      .machine = "${HOSTNAME}"
  apache_error_log_remap:
    type: remap
    inputs: ['apache_error_log']
    drop_on_abort: true
    source: |-
      .machine = "${HOSTNAME}"
      if match!(.message, r'.*mod_fcgid\: stderr\:.*') {
        if ! match!(.message, r'.*PHP (Fatal|Warning).*') {
          abort
        }
      }
sinks:
  int_metrics_export:
    type: "prometheus_exporter"
    address: 0.0.0.0:9598
    auth:
      token: aazf3rta4wbyqjx8TCK
      strategy: bearer
    inputs:
      - int_metrics
  vector_apache_logs:
    type: vector
    inputs:
      - apache_remap
    address: vector-logs.dream.io:9002
    tls:
      enabled: true
      verify_certificate: false
      verify_hostname: false
    healthcheck:
      enabled: false
    buffer:
      when_full: drop_newest
      max_events: 500000
  vector_auth_logs:
    type: vector
    inputs:
      - syslog_auth
      - syslog_oom_filter
    address: vector-logs.dream.io:9003
    tls:
      enabled: true
      verify_certificate: false
      verify_hostname: false
    healthcheck:
      enabled: false
    buffer:
      when_full: drop_newest
      max_events: 50000
  vector_apache_error_logs:
    type: vector
    inputs:
      - apache_error_log_remap
    address: vector-logs.dream.io:9006
    tls:
      enabled: true
      verify_certificate: false
      verify_hostname: false
    healthcheck:
      enabled: false
    buffer:
      when_full: drop_newest
      max_events: 50000