# 配置索引模板名称和模式
setup.template.name: "prod-lessie-server04"
setup.template.pattern: "prod-lessie-server04*"
setup.template.enabled: true
setup.ilm.enabled: true

#主配置文件加载子配置文件
filebeat.config.inputs:
  enabled: true
  path: /etc/filebeat/inputs.d/*.yml
  reload.enabled: true
  reload.period: 10s


# 处理器
processors:
# lessie -------------------------

  - dissect:
      when:
        equals:
          log_type: lessie_search.log
      tokenizer: '%{timestamp} - %{level} - %{module} - %{function} - %{message}'
      field: "message"
      target_prefix: "mylog"
      ignore_missing: true
      overwrite_keys: true

  # 针对带有 [level: | event: | msg: | context:] 的日志，再做一次 dissect
  - dissect:
      when:
        regexp:
          mylog.message: '^\[level:.*\]'
      tokenizer: '[level: %{event_level} | event: %{event} | msg: %{msg} | context: %{context}]'
      field: "mylog.message"
      target_prefix: "mylog"
      ignore_missing: true
      overwrite_keys: true

  # 把 context 再拆成独立字段
  - script:
      lang: javascript
      id: parse_context
      source: >
        function process(event) {
          var ctx = event.Get("mylog.context");
          if (ctx) {
            var parts = ctx.split(",");
            parts.forEach(function(p) {
              var kv = p.split(":");
              if (kv.length == 2) {
                event.Put("mylog." + kv[0].trim(), kv[1].trim());
              }
            });
          }
        }
# lessie ------------------------


#输出
output.elasticsearch:
  hosts: ["http://106.53.194.199:9200"]
  username: "admin"
  password: "123456"
  index: "%{[environment]}-%{[application]}-%{+yyyy.MM.dd}"  # 按月分割索引
  bulk_max_size: 50       # 单批次传输最大文档数
  worker: 1                # 并行工作线程数
  timeout: 15s

# 日志记录
logging.level: info
logging.to_files: true
logging.files:
  path: /var/log/filebeat
  name: filebeat.log
  keepfiles: 7
  permissions: 0644

# 设置队列和内存使用
queue.mem:
  events: 1024
  flush.min_events: 512
  flush.timeout: 10s