^^&&^^

Edit File: vector.yaml

sources:
  # System logs, replacing the auth/kern omuxsock sockets rsyslog fed.
  journald:
    type: journald
    # No checkpoint yet: start at "now" rather than replaying the whole journal.
    since_now: true
    current_boot_only: false
    # vector.service would loop its own stdout back in.
    exclude_matches:
      _SYSTEMD_UNIT: ["vector.service"]
  apache_log:
    type: socket
    path: /var/lib/vector/vector-apache.sock
    socket_file_mode: 0o755
    framing:
      method: "newline_delimited"
    mode: unix_datagram
    decoding:
      codec: bytes
  int_metrics:
    type: internal_metrics
  apache_error_log:
    type: socket
    path: /var/lib/vector/apache-error-log.sock
    socket_file_mode: 0o755
    framing:
      method: "newline_delimited"
    mode: unix_datagram
    decoding:
      codec: bytes
transforms:
  # Rebuild the syslog-codec fields journald doesn't provide, so the 9003
  # aggregator schema is unchanged.
  syslog_normalize:
    type: remap
    inputs:
      - journald
    source: |-
      .hostname = .host
      .appname = .SYSLOG_IDENTIFIER
      .procid = ."_PID"
      .machine = "${HOSTNAME}"
      severities = {"0":"emerg","1":"alert","2":"crit","3":"err","4":"warning","5":"notice","6":"info","7":"debug"}
      .severity = get(severities, [.PRIORITY]) ?? null
      facilities = {"0":"kern","1":"user","2":"mail","3":"daemon","4":"auth","5":"syslog","6":"lpr","7":"news","8":"uucp","9":"cron","10":"authpriv","11":"ftp","12":"ntp","13":"audit","14":"alert","15":"clock","16":"local0","17":"local1","18":"local2","19":"local3","20":"local4","21":"local5","22":"local6","23":"local7"}
      .facility = get(facilities, [.SYSLOG_FACILITY]) ?? .SYSLOG_FACILITY
  # Kern-only tap for the oom_kills_total metrics; the raw lines already reach
  # 9003 via syslog_normalize.
  syslog_kern:
    type: filter
    inputs:
      - journald
    condition: '.SYSLOG_FACILITY == "0"'
  oom_kill_filter:
    type: filter
    inputs:
      - syslog_kern
    condition: 'contains(string!(.message), "oom-kill:")'
  oom_parse:
    type: remap
    inputs:
      - oom_kill_filter
    drop_on_abort: true
    source: |-
      # oom_memcg is only present for cgroup-constrained OOMs; a global_oom
      # (constraint=CONSTRAINT_NONE) omits it, so keep that group optional.
      parsed, err = parse_regex(.message, r'oom-kill:.*?(?:oom_memcg=(?P<oom_memcg>[^,]+),)?task_memcg=(?P<task_memcg>[^,]+),task=(?P<task>[^,]+),pid=(?P<pid>\d+),uid=(?P<uid>\d+)')
      if err != null {
        abort
      }
      . = merge(., parsed)
      # A global OOM has no owning cgroup, so there's no user to attribute it to.
      .user = "global"
      if .oom_memcg != null {
        user_match, user_err = parse_regex(.oom_memcg, r'/(?P<user>[^/]+)$')
        if user_err == null {
          .user = user_match.user
        } else {
          .user = "unknown"
        }
      }
      .process_name = .task
      .machine = "${HOSTNAME}"
  oom_metrics:
    type: log_to_metric
    inputs:
      - oom_parse
    metrics:
      - type: counter
        name: oom_kills_total
        field: process_name
        kind: incremental
        tags:
          user: "{{user}}"
          process_name: "{{process_name}}"
          machine: "{{machine}}"
  apache_remap:
    type: remap
    inputs: ['apache_log']
    source: |-
      .machine = "${HOSTNAME}"
  apache_error_log_remap:
    type: remap
    inputs: ['apache_error_log']
    drop_on_abort: true
    source: |-
      .machine = "${HOSTNAME}"
      if match!(.message, r'.*mod_fcgid\: stderr\:.*') {
        if ! match!(.message, r'.*PHP (Fatal|Warning).*') {
          abort
        }
      }
sinks:
  int_metrics_export:
    type: "prometheus_exporter"
    address: 0.0.0.0:9598
    auth:
      token: aazf3rta4wbyqjx8TCK
      strategy: bearer
    inputs:
      - int_metrics
      - oom_metrics
  vector_apache_logs:
    type: vector
    inputs:
      - apache_remap
    address: vector-logs.dream.io:9002
    tls:
      enabled: true
      verify_certificate: false
      verify_hostname: false
    healthcheck:
      enabled: false
    buffer:
      when_full: drop_newest
      max_events: 500000
  vector_syslog_logs:
    type: vector
    inputs:
      - syslog_normalize
    address: vector-logs.dream.io:9003
    tls:
      enabled: true
      verify_certificate: false
      verify_hostname: false
    healthcheck:
      enabled: false
    buffer:
      when_full: drop_newest
      max_events: 500000
  vector_apache_error_logs:
    type: vector
    inputs:
      - apache_error_log_remap
    address: vector-logs.dream.io:9006
    tls:
      enabled: true
      verify_certificate: false
      verify_hostname: false
    healthcheck:
      enabled: false
    buffer:
      when_full: drop_newest
      max_events: 50000