# ansible_managed
input {
  beats {
    port => 5045
  }
}

filter {
  grok {
    match => [ "message" , "%{COMBINEDAPACHELOG}+%{GREEDYDATA:extra_fields}"]
    overwrite => [ "message" ]
  }

  mutate {
    rename => { "extra_fields" => "real_ip" }
    gsub => [ "real_ip", "\"", "" ] # remove qoutes
    gsub => [ "real_ip", " ", "" ]  # remove whitespace

    # fix
    convert => ["http.response.status_code", "integer"]
    convert => ["http.response.body.bytes", "integer"]
    convert => ["responsetime", "float"]
    remove_field => ["host.containerized"]
  }

  geoip {
    source => "real_ip"
    target => "geoip"
    fields => ["city_name", "region_name", "country_name", "region_iso_code", "country_code2", "location"]
  }

  date {
    match => [ "timestamp" , "dd/MMM/YYYY:HH:mm:ss Z" ]
    remove_field => [ "timestamp" ]
  }
}

output {
  elasticsearch {
    # Reach Elasticsearch over the shared docker network using its service name.
    hosts => ["{{ 'https' if elk_tls_enabled else 'http' }}://{{ elk_elasticsearch_client_host }}:9200"]
{% if elk_effective_security_enabled %}
    user => "logstash_system"
    password => "{{ elk_logstash_system_password }}"
{% endif %}
{% if elk_tls_enabled %}
    ssl_enabled => true
    # Public CA (Let's Encrypt) - trusted by Logstash's default JVM trust
    # store already, no custom CA needs to be supplied here.
{% endif %}
    index => "weblogs-%{+YYYY.MM}"
  }
}