---

dmitriev-aal@VDI-Dmitriev-A:~$ kubectl --context devstbl -n vector \
>   get cm vector-agent -o jsonpath='{.data.vector\.yaml}' \
>   | grep -A35 -E '^  (throttle|sanitizeEvents|parseJSON):'
  parseJSON:
    inputs:
    - sanitizeEvents
    source: |
      json_message,err = parse_json(.message)

      ## https://gitlab.rshbdev.ru/rshbintech/integrations/ckpr/board/-/issues/2336
      ## Replace @timestamp with .timestamp, or use timestamp if it exists
      if exists(json_message.timestamp) {
        del(json_message.@timestamp)
      } else {
        json_message.timestamp = del(json_message.@timestamp)
      }

      if err == null {
        pod_name = .kubernetes.container_name
        if exists(.kubernetes.labels.app) && .kubernetes.labels.app != pod_name {
          app_name = .kubernetes.labels.app
          . = set!(value: ., path: ["parsed", pod_name, app_name ], data: json_message)
        } else {
          . = set!(value: ., path: ["parsed", pod_name ], data: json_message)
        }
        del(.message)
      }

      . = map_keys(., recursive: true) -> |key| { replace(key, ".", "_") }
    type: remap
  platformLogs:
    condition:
      source: .kubernetes.namespace_name == "platform"
      type: vrl
    inputs:
    - parseJSON
    type: filter
  sanitizeEvents:
    inputs:
    - sanitizeKubernetes
    source: |
      if .kubernetes.container_name == "calico-node" {
        if match(.message, r'INFO') ?? false {
          abort
        }
      }

      if .kubernetes.namespace_name == "topolvm-system" {
        if match(.message, r'"level":"info"') ?? false {
          abort
        }
      }
    type: remap
  sanitizeJournalD:
    inputs:
    - journaldSource
    source: |
      del(.PRIORITY)
      del(.SYSLOG_FACILITY)
      del(._BOOT_ID)
      del(._CAP_EFFECTIVE)
      del(._EXE)
      del(._COMM)
      del(._GID)
      del(._MACHINE_ID)
      del(._SELINUX_CONTEXT)
      del(._STREAM_ID)
      del(._SYSTEMD_INVOCATION_ID)
      del(.__MONOTONIC_TIMESTAMP)
      del(.__REALTIME_TIMESTAMP)
      del(._UID)
      . = map_keys(., recursive: true) -> |key| { replace(key, r'^_', "") }
    type: remap
--
  throttle:
    exclude:
      source: |
        .kubernetes.namespace_name == "kube-system" || .kubernetes.namespace_name == "istio-system" || .kubernetes.namespace_name == "isys-suz-dev"
      type: vrl
    inputs:
    - sanitizeParsedJSON
    key_field: '{{ kubernetes.pod_name }}-{{ kubernetes.container_name }}'
    threshold: 100
    type: throttle
    window_secs: 10
dmitriev-aal@VDI-Dmitriev-A:~$