---
# Redis log collector for vector

sources:
  redis_raw:
    type: file
    read_from: {{ vector_read_from|default('beginning') }}
    include: [ "/var/log/redis/*.log" ]
    ignore_not_found: true

transforms:
  redis_logs:
    type: remap
    inputs: [redis_raw]
    source: |
      .job = "redis"
      ._time = format_timestamp(.timestamp, "%Y-%m-%dT%H:%M:%S%.fZ") ?? now()
      .ip = "{{ inventory_hostname }}"
      .cls = "{{ redis_cluster }}"
      .ins = replace(replace(string!(.file), r'/var/log/redis/', ""), r'\.log$', "")
      m = parse_regex(.message, r'^(?P<pid>\d+):(?P<role>[XCMS]) (?P<ts>\d{2} \w{3} \d{4} \d{2}:\d{2}:\d{2}\.\d{3}) (?P<lvl>[\*\#\-\.]) (?P<msg>.*)$') ?? {}
      if exists(m.ts) {
        ts = parse_timestamp(string!(m.ts), "%d %b %Y %H:%M:%S%.f") ?? null
        if ts != null { ._time = format_timestamp!(ts, "%Y-%m-%dT%H:%M:%S%.fZ") }
        lvl = string!(m.lvl)
        .level = if lvl == "*" { "WARN" } else if lvl == "#" { "NOTICE" } else if lvl == "." { "DEBUG" } else { "INFO" }
      }
      del(.source_type); del(.file); del(.host); del(.timestamp)
...
