#/*
#Copyright 2020-2021 IBM Inc. All rights reserved
#SPDX-License-Identifier: Apache-2.0
#*/

input {
    beats {
 	    port => <port>
 	    type => "filebeat"
 	    # For SSL over Filebeat, uncomment the following lines after generating an SSL key and a certificate authority (CA) using GuardAPI (see documentation), copy the public certificate authority (CA) to your data source and adjust Filebeat configuration:
 	    #ssl_enabled => true
 	    #ssl_certificate => "${SSL_DIR}/tls.crt"
 	    #ssl_key => "${SSL_DIR}/tls.key"
 	    # Uncomment the ssl_key_passphrase line for Guardium Data Protection v12.2.3 (or patch 5008) and above to use encrypted private keys
 	    # ssl_key_passphrase => "${ssl_key_passphrase}"
 	    # ssl_client_authentication => "none"
    }
}
filter{
  if [type] == "filebeat" and "guc_filter_param_datasource_tag" in [tags] {
    mutate { add_field => { "source_program" => "mongod" } }
    mutate { add_field => { "server_hostname" => "%{[host][name]}" } }
    mutate { add_field => { "server_ip" => "%{[host][ip][0]}" } }
    mutate { replace => { "message" => "%{source_program}: %{message}" } }

    mongodb_guardium_filter {}

    if "_mongoguardium_json_parse_error" not in [tags] {
      mutate { remove_field => ["message","syslog_timestamp","source_program","program","syslog_pid","syslog_message","server_hostname","client_hostname","host","ecs","log","agent","input"] }
    }
  }

# uncomment to test events/sec
# 	metrics {
#		meter => "events"
#		add_tag => "metric"
# 	}
}