filter f_bind9_primary { message("bind9-primary"); };
filter f_bind9_secondary { message("bind9-secondary"); };

rewrite r_docker_image {
  subst("^5000/tlp/", "image:", value("MESSAGE"));
  subst(":(?=(\d*\.\d*\.\d*))", " version:", value("MESSAGE"));
  subst('(\/)(?=\S*\[)', " container_name:", value("MESSAGE"));
  subst('((?!=container_name:(\S*))\[(?=\d*))', " pid:", value("MESSAGE"));
  subst('((?!=pid:(\d*))\]:)', "", value("MESSAGE"));
  subst('((?!=pid:(\d*))\ )', " datetime:", value("MESSAGE"));
  subst('((?!=datetime:(\d*-\w*-\d*))\ )', "_", value("MESSAGE"));
  subst('((?!=datetime:(\d*-\w*-\d*_\d*)):)', ".", value("MESSAGE"));
  subst('((?!=datetime:(\d*-\w*-\d*_\d*\.\d*)):)', ".", value("MESSAGE"));
};

parser p_bind_message {
  csv-parser(
    prefix("bind9.")
    flags(strip-whitespace)
    delimiters(" ")
    columns("docker_header", "date", "time", "client.header", "client.object_id", "client.ip_port", "client.request", "query.header", "query.request", "query.class", "query.type", "query.flags")
  );
};

parser p_bind_kv {
  kv-parser(
    prefix("bind9.")
    value-separator(":")
  );
};

parser p_bind_client_ip_geoip2_city {
  geoip2(
    "${kv.SRC}",
    prefix( "geoip2.source." )
    database( "/config/GeoIP/GeoLite2-City.mmdb" )
  );
};

destination d_bind_logs {
  elasticsearch-http(
    index("bind9-logs")
    type("")
    user("elastic")
    password("forty6and2")
    url("http://pi501.in.thelinuxpro.net:9200/_bulk")
    template("$(format-json --scope rfc5424 --scope dot-nv-pairs
    --rekey .* --shift 1 --scope nv-pairs
    --exclude DATE @timestamp=${ISODATE})")
    persist-name("d_bind_logs")
  );
};

log {
  source(s_network_udp);
  filter(f_bind9_primary);
  parser(p_bind_message);
 # rewrite(r_docker_image);
  #parser(p_bind_kv);
  destination(d_bind_logs);
  flags(final);
};

log {
  source(s_network_udp);
  filter(f_bind9_secondary);
  parser(p_bind_message);
#  rewrite(r_docker_image);
#  parser(p_bind_kv);
  destination(d_bind_logs);
  flags(final);
};