demo/k8s/helm/logsys/templates/configmap-vector.yaml

apiVersion: v1
kind: ConfigMap
metadata:
  name: vector-config
  namespace: {{ .Release.Namespace }}
  labels:
    app: vector
data:
  vector.toml: |
    data_dir = "/var/lib/vector"

    [sources.kubernetes_logs]
    type = "kubernetes_logs"
    read_from = "end"

    [transforms.parse_and_enrich]
    type = "remap"
    inputs = ["kubernetes_logs"]
    drop_on_abort = false
    source = """
    log_line = .log
    if log_line == null { log_line = .message }
    if log_line == null { log_line = .msg }
    log_line = to_string(log_line) ?? ""

    parsed = null
    if starts_with(log_line, "{") {
      parsed = parse_json(log_line) ?? null
    }

    if parsed != null && is_object(parsed) {
      msg_val = parsed.message
      if msg_val == null { msg_val = parsed.msg }
      if msg_val != null { .message = msg_val }

      if parsed.level != null { .level = parsed.level }
      if parsed.app != null { .app = parsed.app }
      if parsed.env != null { .env = parsed.env }
      if parsed.event_class != null { .event_class = parsed.event_class }
      if parsed.event != null { .event_class = parsed.event }
      if parsed.uri != null { .uri = parsed.uri }
      if parsed.uri_group != null { .uri_group = parsed.uri_group }
      if parsed.status != null { .status = parsed.status }
      if parsed.duration != null { .duration = parsed.duration }
      if parsed.traceId != null { .traceId = parsed.traceId }
      if parsed.userId != null { .userId = parsed.userId }
      if parsed.orderId != null { .orderId = parsed.orderId }
      if parsed.error != null { .error = parsed.error }
      if parsed.logger_name != null { .logger = parsed.logger_name }
      if parsed.thread_name != null { .thread = parsed.thread_name }
    }

    if .message == null { .message = log_line }

    app_val = .app
    if app_val == null { app_val = .kubernetes.labels.app }
    if app_val == null { app_val = .kubernetes.pod_labels.app }
    if app_val == null { app_val = .kubernetes.container_name }
    if app_val == null { app_val = .kubernetes.pod_name }
    if app_val == null { app_val = "unknown" }
    .app = app_val

    env_str = to_string(.env) ?? ""
    if contains(env_str, "prod") {
      .env = "prod"
    } else if contains(env_str, "stage") {
      .env = "stage"
    } else if contains(env_str, "dev") {
      .env = "dev"
    } else if contains(env_str, "local") {
      .env = "local"
    } else if env_str != "" {
      .env = env_str
    } else {
      .env = "unknown"
    }

    uri_str = to_string(.uri) ?? ""
    if uri_str != "" { .uri = uri_str }

    if !exists(.uri_group) || .uri_group == "" {
      if uri_str != "" {
        if starts_with(uri_str, "/order/") {
          .uri_group = "/order/*"
        } else if starts_with(uri_str, "/payment/") {
          .uri_group = "/payment/*"
        } else if starts_with(uri_str, "/gateway/") {
          .uri_group = "/gateway/*"
        } else {
          .uri_group = "/other"
        }
      } else {
        .uri_group = "/other"
      }
    }

    if !exists(.event_class) || .event_class == "" {
      if uri_str != "" {
        if contains(uri_str, "order") {
          .event_class = "order"
        } else if contains(uri_str, "payment") {
          .event_class = "payment"
        } else if contains(uri_str, "login") {
          .event_class = "auth"
        } else {
          .event_class = "api"
        }
      } else {
        .event_class = "api"
      }
    }

    level_str = to_string(.level) ?? ""
    if level_str != "" { .level = level_str } else { .level = "INFO" }

    status_str = to_string(.status) ?? ""
    if status_str != "" { .status = status_str } else { .status = "unknown" }

    duration_str = to_string(.duration) ?? ""
    duration_str = replace!(duration_str, "ms", "")
    .duration_ms = to_int(duration_str) ?? null
    """

    [sinks.loki]
    type = "loki"
    inputs = ["parse_and_enrich"]
    endpoint = "{{ .Values.vector.loki.endpoint }}"
    encoding.codec = "json"
    buffer.type = "memory"
    buffer.max_events = 10000
    [sinks.loki.labels]
    env = '{{ "{{ env }}" }}'
    app = '{{ "{{ app }}" }}'
    level = '{{ "{{ level }}" }}'
    event_class = '{{ "{{ event_class }}" }}'
    uri_group = '{{ "{{ uri_group }}" }}'
    status = '{{ "{{ status }}" }}'