[SERVICE]
    # Flush
    # =====
    # set an interval of seconds before to flush records to a destination
    flush        1

    # flush.adaptive
    # --------------
    # Enable adaptive flush interval adjustments based on output chunk
    # backpressure.
    #
    # flush.adaptive off

    # flush.adaptive.min_interval
    # ---------------------------
    # lower bound for adaptive flush interval in seconds.
    #
    # flush.adaptive.min_interval 0.5

    # flush.adaptive.max_interval
    # ---------------------------
    # upper bound for adaptive flush interval in seconds.
    #
    # flush.adaptive.max_interval 2.0

    # flush.adaptive.low_pressure
    # ---------------------------
    # output chunk pressure (%) threshold considered mostly idle.
    #
    # flush.adaptive.low_pressure 25

    # flush.adaptive.medium_pressure
    # ------------------------------
    # output chunk pressure (%) threshold considered moderate pressure.
    #
    # flush.adaptive.medium_pressure 50

    # flush.adaptive.high_pressure
    # ----------------------------
    # output chunk pressure (%) threshold considered sustained pressure.
    #
    # flush.adaptive.high_pressure 75

    # flush.adaptive.up_steps
    # -----------------------
    # consecutive pressure samples required before moving to a faster flush
    # step. minimum: 1
    #
    # flush.adaptive.up_steps 2

    # flush.adaptive.down_steps
    # -------------------------
    # consecutive idle samples required before moving to a slower flush step.
    # minimum: 1
    #
    # flush.adaptive.down_steps 3

    # Daemon
    # ======
    # instruct Fluent Bit to run in foreground or background mode.
    daemon       off

    # Log_Level
    # =========
    # Set the verbosity level of the service, values can be:
    #
    # - error
    # - warning
    # - info
    # - debug
    # - trace
    #
    # by default 'info' is set, that means it includes 'error' and 'warning'.
    log_level    info

    # Parsers File
    # ============
    # specify an optional 'Parsers' configuration file
    parsers_file parsers.conf

    # Plugins File
    # ============
    # specify an optional 'Plugins' configuration file to load external plugins.
    plugins_file plugins.conf

    # HTTP Server
    # ===========
    # Enable/Disable the built-in HTTP Server for metrics
    http_server  Off
    http_listen  0.0.0.0
    http_port    2020

    # Storage
    # =======
    # Fluent Bit can use memory and filesystem buffering based mechanisms
    #
    # - https://docs.fluentbit.io/manual/administration/buffering-and-storage
    #
    # storage metrics
    # ---------------
    # publish storage pipeline metrics in '/api/v1/storage'. The metrics are
    # exported only if the 'http_server' option is enabled.
    #
    storage.metrics on

    # storage.path
    # ------------
    # absolute file system path to store filesystem data buffers (chunks).
    #
    storage.path /var/lib/cpanel_backlog

    # storage.sync
    # ------------
    # configure the synchronization mode used to store the data into the
    # filesystem. It can take the values normal or full.
    #
    storage.sync full

    # storage.checksum
    # ----------------
    # enable the data integrity check when writing and reading data from the
    # filesystem. The storage layer uses the CRC32 algorithm.
    #
    storage.checksum on

    # storage.backlog.mem_limit
    # -------------------------
    # if storage.path is set, Fluent Bit will look for data chunks that were
    # not delivered and are still in the storage layer, these are called
    # backlog data. This option configure a hint of maximum value of memory
    # to use when processing these records.
    #
    storage.backlog.mem_limit 500M


# ============================================================
# cPanel logs
# ============================================================
[INPUT]
    Name                tail
    Path                /usr/local/cpanel/logs/*
    Path_Key            source_file
    Tag                 cpanel.logs

    DB                  /var/log/fluent-bit-cpanel.db
    DB.Journal_Mode     wal

    Refresh_Interval    5
    Skip_Long_Lines     true
    Mem_Buf_Limit       512MB
    Storage.Type        filesystem

    Exclude_Path        /usr/local/cpanel/logs/archive/*,/usr/local/cpanel/logs/php-fpm/*,/usr/local/cpanel/logs/cpbackup/*,/usr/local/cpanel/logs/cpbackup_transporter/*,/usr/local/cpanel/logs/update_analysis/*


# ============================================================
# Top-level Linux / system logs
# Only regular text logs that we actually want
# ============================================================
[INPUT]
    Name                tail

    Path                /var/log/auth.log,/var/log/syslog,/var/log/kern.log,/var/log/mail.log,/var/log/mail.err,/var/log/fail2ban.log,/var/log/lfd.log,/var/log/exim_mainlog,/var/log/exim_rejectlog,/var/log/exim_paniclog,/var/log/chkservd.log,/var/log/cloud-init.log,/var/log/cloud-init-output.log,/var/log/dpkg.log,/var/log/alternatives.log

    Path_Key            source_file
    Tag                 system.logs

    DB                  /var/log/fluent-bit-system.db
    DB.Journal_Mode     wal

    Refresh_Interval    5
    Skip_Long_Lines     true
    Mem_Buf_Limit       512MB
    Storage.Type        filesystem


# ============================================================
# Apache logs
# ============================================================
[INPUT]
    Name                tail
    Path                /var/log/apache2/*
    Path_Key            source_file
    Tag                 apache.logs

    DB                  /var/log/fluent-bit-apache.db
    DB.Journal_Mode     wal

    Refresh_Interval    5
    Skip_Long_Lines     true
    Mem_Buf_Limit       512MB
    Storage.Type        filesystem

    Exclude_Path        /var/log/apache2/*.gz,/var/log/apache2/*.1


# ============================================================
# Auditd
# ============================================================
[INPUT]
    Name                tail
    Path                /var/log/audit/audit.log
    Path_Key            source_file
    Tag                 audit.logs

    DB                  /var/log/fluent-bit-audit.db
    DB.Journal_Mode     wal

    Refresh_Interval    5
    Skip_Long_Lines     true
    Mem_Buf_Limit       512MB
    Storage.Type        filesystem


[FILTER]
    Name    lua
    Match   *
    Script    add_log_source.lua


    Call  add_log_source
[OUTPUT]
    Name                        http
    Host                        118.67.213.76
    Port                        31599
    Format                      json
    HTTP_Method                 POST
    URI                         /logs
    Match                       *
    Retry_Limit                 10
    Storage.Total_Limit_Size    4G