vector-example.yaml

sources:
  bunny_src:
    type: syslog
    address: '0.0.0.0:6514'
    mode: udp

sinks:
  bunny_file_sink:
    type: file
    inputs:
      - bunny_shaker
    compression: none
    path: /logs/bunny_log-%Y-%m-%d.log
    encoding:
      codec: json

  bunny_search_sink:
    type: elasticsearch
    inputs:
      - bunny_shaker
    endpoints: [http://openobserve:5080/api/default/]
    bulk:
      index: bunny_log
    auth:
      strategy: basic
      user: "${SEARCH_EMAIL:?search email is required}"
      password: "${SEARCH_PWD:?search pwd is required}"
    healthcheck:
      enabled: false

  bunny_metric_exporter:
    type: prometheus_exporter
    inputs:
      - bunny_metric
    default_namespace: bunny
    flush_period_secs: 20
    # address: 0.0.0.0:9598 # this is already default

  # alternate to bunny_metric_exporter above
  bunny_metric_sink:
    type: prometheus_remote_write
    inputs:
      - bunny_metric
    endpoint: "http://openobserve:5080/api/default/prometheus/api/v1/write"
    default_namespace: bunny
    auth:
      strategy: basic
      user: "${SEARCH_EMAIL:?search email is required}"
      password: "${SEARCH_PWD:?search pwd is required}"
    batch:
      timeout_secs: 10

transforms:
  # optionally verify bunnycdn token/password
  # password going to come in as the event object key: OptionalBunnyToken@workerid
  bunny_prefilter:
    type: filter
    inputs:
      - bunny_src
    condition: 'starts_with(string!(keys(.)[0]), get_env_var!("BUNNY_TOKEN"))'

  # parse log PathAndQuery for /shake aka tree shaking
  # to get event Action(ea), Category (ec), and Value (ev)
  bunny_transform:
    type: remap
    inputs:
      - bunny_prefilter
    file: /etc/vector/stat-transform.vrl

  bunny_shaker:
    type: filter
    inputs:
      - bunny_transform
    condition: 'starts_with(string!(.PathAndQuery), "/shake/")'

  bunny_metric:
    type: log_to_metric
    inputs:
      - bunny_shaker
    metrics:
      - type: counter
        field: ev
        name: "event_{{ ec }}"
        namespace: bunny
        _timestamp: _timestamp
        tags:
          action: "{{ ea }}"
          label: "{{ el }}"
          value: "{{ ev }}"