input {
    beats {
        host => "0.0.0.0"
        port => 5044
    }
}

filter {
    mutate {
        # Remove some fields that are not needed.
        remove_field => [
            "[agent]",
            "[journald]",
            "[syslog]",
            "[systemd][invocation_id]",
            "[event][original]",
            "[log][offset]",
            "[log][syslog]"
        ]

        # Tag with the provided metadata.
        add_field => {
            {{ range $key, $value := .InfoMap }}
            "[metadata][{{ $key }}]" => "{{ $value }}"
            {{ end }}
        }
    }

    # Parse structured logs for following systemd units.
    if [systemd][unit] in ["bootstrapper.service", "constellation-bootstrapper.service"] {
        json {
            source => "message"
            target => "logs"
            skip_on_invalid_json => true
        }
        date {
            match => [ "[logs][ts]", "ISO8601" ]
        }
        mutate {
            replace => {
                "message" => "%{[logs][msg]}"
            }
            remove_field => [
                "[logs][msg]",
                "[logs][ts]"
            ]
        }
        de_dot {
            fields => ["[logs][peer.address]"]
        }
    }
}

output {
    opensearch {
        hosts => "{{ .Host }}"
        index => "systemd-logs-%{+YYYY.MM.dd}"
        user => "{{ .Credentials.Username }}"
        password => "{{ .Credentials.Password }}"
        ssl => true
        ssl_certificate_verification => true
    }
}
