#Copyright 2023 IBM All Rights Reserved.
input {
    beats {
        port => <PORT_NUMBER>
        type => "filebeat"
    }
}
	   	
filter  {
	if [type] == "filebeat" and "couchbase" in [tags]{

	if [message] =~ "RBAC information retrieved"  {
        drop {}
    }
		
		mutate {
			add_field => { "serverIP" => "%{[@metadata][ip_address]}" }
			add_field => { "serverHostname" => "%{[host][name]}" }
			add_field =>  { "Offset" => "%{[event][timezone]}" }
			}

			
		couchbasedb_guardium_plugin_filter{}
		
		mutate { remove_field => ["serverHostname","@version","@timestamp","type","sequence","message","host","tags","input","log","ecs","agent","serverIP"]}
    }
}

output {
     stdout { codec => rubydebug }
}