---

dmitriev-aal@VDI-Dmitriev-A:~$ kubectl --context devstbl -n vector \
>   get cm vector-agent -o yaml | \
>   grep -A25 -B5 -E 'kubernetesLogs:|elasticsearch_sink:|data_dir:'
data:
  vector.yaml: |
    api:
      address: 0.0.0.0:8686
      enabled: true
    data_dir: /var/lib/vector
    expire_metrics_secs: 600
    sinks:
      elasticsearch_journald_sink:
        api_version: v7
        auth:
          password: pe8jefowU5/huK4uc76fh+pHmRgYCdelW7MV3GMjCKc=
          strategy: basic
          user: fluentd
        batch:
          max_bytes: 10485760
        buffer:
          max_size: 314572800
          type: disk
          when_full: block
        bulk:
          index: journald-%Y.%m.%d
        compression: none
        endpoints:
        - https://elastic-data.rshbdev.ru
        inputs:
        - sanitizeJournalD
        mode: normal
        request:
          concurrency: adaptive
        tls:
--
        request:
          concurrency: adaptive
        tls:
          ca_file: /usr/share/cacert/rshb_bundle.pem
        type: elasticsearch
      elasticsearch_sink:
        api_version: v7
        auth:
          password: pe8jefowU5/huK4uc76fh+pHmRgYCdelW7MV3GMjCKc=
          strategy: basic
          user: fluentd
        batch:
          max_bytes: 20971520
        buffer:
          max_size: 1610612736
          type: disk
          when_full: block
        bulk:
          index: logstash-%Y.%m.%d
        compression: none
        endpoints:
        - https://elastic-data.rshbdev.ru
        inputs:
        - throttle
        mode: normal
        request:
          concurrency: adaptive
        tls:
          ca_file: /usr/share/cacert/rshb_bundle.pem
        type: elasticsearch
      metrics:
--
          - nginx.service
          _TRANSPORT:
          - kernel
        since_now: true
        type: journald
      kubernetesLogs:
        extra_label_selector: app.kubernetes.io/name!=grafana-operator,type!=adapter
        glob_minimum_cooldown_ms: 100
        max_line_bytes: 8388608
        max_read_bytes: 8388608
        pod_annotation_fields:
          pod_labels: kubernetes.labels
          pod_namespace: kubernetes.namespace_name
          pod_node_name: kubernetes.node_name
        type: kubernetes_logs
    transforms:
      parseJSON:
        inputs:
        - sanitizeEvents
        source: |
          json_message,err = parse_json(.message)

          ## https://gitlab.rshbdev.ru/rshbintech/integrations/ckpr/board/-/issues/2336
          ## Replace @timestamp with .timestamp, or use timestamp if it exists
          if exists(json_message.timestamp) {
            del(json_message.@timestamp)
          } else {
            json_message.timestamp = del(json_message.@timestamp)
          }

          if err == null {
dmitriev-aal@VDI-Dmitriev-A:~$