prometheus/meta/fluentd.yml

{%- if pillar.get('fluentd', {}).get('agent', {}).get('enabled', False) %}
{% from "prometheus/map.jinja" import alertmanager, sf_notifier with context %}
{%- if alertmanager.enabled and sf_notifier.enabled %}
agent:
  config:
    label:
      sfnotifier:
        input:
          tail_sfnotifier:
            type: tail
            tag: sfnotifier.log
            path: {{ sf_notifier.dir.logs }}/sf-notifier.log
            pos_file: {{ pillar.fluentd.agent.dir.positiondb }}/sfnotifier.pos
            parser:
              type: multi_format
              patterns:
                # sfnotifier log format: https://regex101.com/r/JsYcJU/1
                - type: regexp
                  time_key: Timestamp
                  time_format: '%F %H:%M:%S'
                  keep_time_key: false
                  format: '/^\[(?<Timestamp>.*)\] (?<Severity>.*?) in (?<Module>.*?)\: (?<Payload>.+)$/'
                # http log format: https://regex101.com/r/8i6u1v/2
                - type: regexp
                  time_key: Timestamp
                  time_format: '%d/%b/%Y %H:%M:%S'
                  keep_time_key: false
                  format: '/^(?<http_client_ip_address>[^ ]*) - - \[(?<Timestamp>.*)\] "(?<http_method>\S+) (?<http_url>[^ ]*) \S*" (?<http_status>[^ ]*) -$/'
        filter:
          sfnotifier_record:
            type: record_transformer
            tag: sfnotifier.log
            enable_ruby: true
            remove_keys: priority
            record:
              - name: service
                value: sfnotifier
              - name: severity_label
                value: '${ {"TRACE"=>8,"DEBUG"=>7,"INFO"=>6,"NOTICE"=>5,"WARNING"=>4,"ERROR"=>3,"CRITICAL"=>2,"ALERT"=>1,"EMERGENCY"=>0}.fetch(record["Severity"].to_i, 6) }'
        match:
          push_to_default:
            tag: sfnotifier.**
            type: relabel
            label: default_output
{%- endif %}
{%- endif %}