input {
beats {
	port => <guc_input_param_port>
	type => "filebeat"
	# For SSL over Filebeat, uncomment the following lines after generating a SSL key and a certificate using GuardAPI (see documentation), copy the public certificate to your data source and adjust Filebeat configuration:
	#ssl_enabled => true
	#ssl_certificate => "${SSL_DIR}/tls.crt"
	#ssl_key => "${SSL_DIR}/tls.key"
	# Uncomment the ssl_key_passphrase line for Guardium Data Protection v12.2.3 (or patch 5008) and above to use encrypted private keys
	#ssl_key_passphrase => "${ssl_key_passphrase}"
	#ssl_client_authentication => "none"
}
}

filter {
# For this to work, the Filebeat configuration on your data source should tag the events it is sending.

	# For this to work, the Filebeat configuration on your data source should tag the events it is sending.
	if [type] == "filebeat" and "mysqlpercona" in [tags] {
		mutate { add_field => { "source_program" => "percona-audit" } }
	  	mutate { add_field => { "client_hostname" => "%{[agent][hostname]}" } }
	  	mutate { add_field => { "server_hostname" => "%{[host][hostname]}" } }
	  	mutate { add_field => { "server_ip" => "%{[host][ip][0]}" } }
	  	mutate { replace => { "message" => "percona-audit: %{message}" } }

		mysql_percona_filter {}

		# keep original event fields, for debugging
		if "_mysqlguardium_parse_error" not in [tags] {
			mutate { remove_field => [
					"message", "syslog_timestamp", "source_program", "program",
					"syslog_pid", "syslog_message",
					"server_hostname", "client_hostname", "host",
					"ecs", "log", "agent", "input"]
			}
		}
	}

}