[sources.input_myaudit_kube]
type = "file"
include = ["/var/log/kube-apiserver/audit.log"]
host_key = "hostname"
glob_minimum_cooldown_ms = 15000
ignore_older_secs = 3600
max_line_bytes = 3145728
max_line_bytes_action = "truncate"
max_read_bytes = 262144
rotate_wait_secs = 5

[transforms.input_myaudit_kube_meta]
type = "remap"
inputs = ["input_myaudit_kube"]
source = '''
  . = {"_internal": .}

  ._internal.structured = parse_json!(string!(._internal.message))
  ._internal = merge!(._internal,._internal.structured)

  audit_time, audit_err = parse_timestamp(to_string(._internal.stageTimestamp) ?? "", "%+")
  if audit_err != null {
    audit_time, audit_err = parse_timestamp(to_string(._internal.requestReceivedTimestamp) ?? "", "%+")
  }
  if audit_err == null { ._internal.timestamp = audit_time }

  ._internal.log_source = "kubeAPI"
  ._internal.log_type = "audit"
  ._internal.hostname = get_env_var("VECTOR_SELF_NODE_NAME") ?? ""
  ._internal.openshift = { "cluster_id": "${OPENSHIFT_CLUSTER_ID:-}"}
  ._internal.openshift.sequence = to_unix_timestamp(now(), unit: "nanoseconds")
'''