filter f_bind9_primary { message("bind9-primary"); };
filter f_bind9_secondary { message("bind9-secondary"); };

parser p_bind_kv {
  kv-parser(
    prefix("bind9.")
    value-separator(":")
  );
};

parser p_bind_client_ip_geoip2_city {
  geoip2(
    "${kv.SRC}",
    prefix( "geoip2.source." )
    database( "/config/GeoIP/GeoLite2-City.mmdb" )
  );
};

destination d_bind_logs {
  elasticsearch-http(
    index("bind9-logs")
    type("")
    user("elastic")
    password("forty6and2")
    url("http://pi501.in.thelinuxpro.net:9200/_bulk")
    template("$(format-json --scope rfc5424 --scope dot-nv-pairs
    --rekey .* --shift 1 --scope nv-pairs
    --exclude DATE @timestamp=${ISODATE})")
    persist-name("d_bind_logs")
  );
};

log {
  source(s_network_udp);
  filter(f_bind9_primary);
  parser(p_bind_kv);
  destination(d_bind_logs);
  flags(final);
};

log {
  source(s_network_udp);
  filter(f_bind9_secondary);
  parser(p_bind_kv);
  destination(d_bind_logs);
  flags(final);
};