<filter **>
  @type viaq_data_model
  default_keep_fields CEE,time,@timestamp,aushape,ci_job,collectd,docker,fedora-ci,file,foreman,geoip,hostname,ipaddr4,ipaddr6,kubernetes,level,message,namespace_name,namespace_uuid,offset,openstack,ovirt,pid,pipeline_metadata,rsyslog,service,systemd,tags,testcase,tlog,viaq_msg_id
  extra_keep_fields "#{ENV['CDM_EXTRA_KEEP_FIELDS'] || ''}"
  keep_empty_fields "#{ENV['CDM_KEEP_EMPTY_FIELDS'] || 'message'}"
  use_undefined "#{ENV['CDM_USE_UNDEFINED'] || false}"
  undefined_name "#{ENV['CDM_UNDEFINED_NAME'] || 'undefined'}"
  rename_time "#{ENV['CDM_RENAME_TIME'] || true}"
  rename_time_if_missing "#{ENV['CDM_RENAME_TIME_IF_MISSING'] || false}"
  src_time_name "#{ENV['CDM_SRC_TIME_NAME'] || 'time'}"
  dest_time_name "#{ENV['CDM_DEST_TIME_NAME'] || '@timestamp'}"
  pipeline_type "#{ENV['PIPELINE_TYPE'] || 'collector'}"
  undefined_to_string "#{ENV['CDM_UNDEFINED_TO_STRING'] || 'false'}"
  undefined_dot_replace_char "#{ENV['CDM_UNDEFINED_DOT_REPLACE_CHAR'] || 'UNUSED'}"
  undefined_max_num_fields "#{ENV['CDM_UNDEFINED_MAX_NUM_FIELDS'] || '-1'}"
  process_kubernetes_events "#{ENV['TRANSFORM_EVENTS'] || 'false'}"
  <formatter>
    enabled false
    tag "audit.log**"
    type sys_var_log
  </formatter>
  <formatter>
    tag "system.var.log**"
    type sys_var_log
    remove_keys host,pid,ident
  </formatter>
  <formatter>
    tag "journal.system**"
    type sys_journal
    remove_keys log,stream,MESSAGE,_SOURCE_REALTIME_TIMESTAMP,__REALTIME_TIMESTAMP,CONTAINER_ID,CONTAINER_ID_FULL,CONTAINER_NAME,PRIORITY,_BOOT_ID,_CAP_EFFECTIVE,_CMDLINE,_COMM,_EXE,_GID,_HOSTNAME,_MACHINE_ID,_PID,_SELINUX_CONTEXT,_SYSTEMD_CGROUP,_SYSTEMD_SLICE,_SYSTEMD_UNIT,_TRANSPORT,_UID,_AUDIT_LOGINUID,_AUDIT_SESSION,_SYSTEMD_OWNER_UID,_SYSTEMD_SESSION,_SYSTEMD_USER_UNIT,CODE_FILE,CODE_FUNCTION,CODE_LINE,ERRNO,MESSAGE_ID,RESULT,UNIT,_KERNEL_DEVICE,_KERNEL_SUBSYSTEM,_UDEV_SYSNAME,_UDEV_DEVNODE,_UDEV_DEVLINK,SYSLOG_FACILITY,SYSLOG_IDENTIFIER,SYSLOG_PID
  </formatter>
  <formatter>
    tag "kubernetes.journal.container**"
    type k8s_journal
    remove_keys "#{ENV['K8S_FILTER_REMOVE_KEYS'] || 'log,stream,MESSAGE,_SOURCE_REALTIME_TIMESTAMP,__REALTIME_TIMESTAMP,CONTAINER_ID,CONTAINER_ID_FULL,CONTAINER_NAME,PRIORITY,_BOOT_ID,_CAP_EFFECTIVE,_CMDLINE,_COMM,_EXE,_GID,_HOSTNAME,_MACHINE_ID,_PID,_SELINUX_CONTEXT,_SYSTEMD_CGROUP,_SYSTEMD_SLICE,_SYSTEMD_UNIT,_TRANSPORT,_UID,_AUDIT_LOGINUID,_AUDIT_SESSION,_SYSTEMD_OWNER_UID,_SYSTEMD_SESSION,_SYSTEMD_USER_UNIT,CODE_FILE,CODE_FUNCTION,CODE_LINE,ERRNO,MESSAGE_ID,RESULT,UNIT,_KERNEL_DEVICE,_KERNEL_SUBSYSTEM,_UDEV_SYSNAME,_UDEV_DEVNODE,_UDEV_DEVLINK,SYSLOG_FACILITY,SYSLOG_IDENTIFIER,SYSLOG_PID'}"
  </formatter>
  <formatter>
    tag "kubernetes.var.log.containers.eventrouter-** kubernetes.var.log.containers.cluster-logging-eventrouter-**"
    type k8s_json_file
    remove_keys log,stream,CONTAINER_ID_FULL,CONTAINER_NAME
    process_kubernetes_events "#{ENV['TRANSFORM_EVENTS'] || 'true'}"
  </formatter>
  <formatter>
    tag "kubernetes.var.log.containers**"
    type k8s_json_file
    remove_keys log,stream,CONTAINER_ID_FULL,CONTAINER_NAME
  </formatter>
  <elasticsearch_index_name>
    enabled "#{ENV['ENABLE_ES_INDEX_NAME'] || 'true'}"
    tag "journal.system** system.var.log** audit.log** %OCP_FLUENTD_TAGS%"
    name_type operations_full
  </elasticsearch_index_name>
  <elasticsearch_index_name>
    enabled "#{ENV['ENABLE_ES_INDEX_NAME'] || 'true'}"
    tag "**"
    name_type project_full
  </elasticsearch_index_name>
</filter>
