input {
	beats {
		port => <PORT_NUMBER>
		type => "filebeat"
		# ssl_enabled => true
		# ssl_certificate => "${SSL_DIR}/tls.crt"
		# ssl_key => "${SSL_DIR}/tls.key"
		# Uncomment the ssl_key_passphrase line for Guardium Data Protection v12.2.3 (or patch 5008) and above to use encrypted private keys
		# ssl_key_passphrase => "${ssl_key_passphrase}"
		# ssl_client_authentication => "none"
	}
}

filter {
	if [type] == "filebeat" and "singlestore" in [tags] {

        mutate {
            split => { "message" => "," }
        }

        if [message][0] == "0" or [message][7] == "" or [message][7] == "distributed" or [message][8] == "[unknown]" {
            drop { }
        }

        mutate {
            remove_tag => ["beats_input_codec_plain_applied"]
            join => { "message" => "," }
            add_field => { "serverIP" => "%{[host][ip][0]}" }
            add_field => { "serverHostname" => "%{[host][name]}" }
        }

        singlestoredb_guardium_filter{}
	}
}