# Search for and replace the "REPLACE ME" fields

mode: daemonset

# Kubernetes metriklerini etkinleştir
presets:
  kubernetesAttributes:
    enabled: true
  kubeletMetrics:
    enabled: false # Disabled since we're using custom kubeletstats receiver
  hostMetrics:
    enabled: true
  logsCollection:
    enabled: true

image:
  repository: otel/opentelemetry-collector-contrib
  tag: "latest"

# Re-enabling syslog UDP port for receiving logs
ports:
  otlp:
    enabled: true
    containerPort: 4317
    servicePort: 4317
    hostPort: 4317
    protocol: TCP
    appProtocol: grpc
  otlp-http:
    enabled: true
    containerPort: 4318
    servicePort: 4318
    hostPort: 4318
    protocol: TCP
  syslog-udp:
    enabled: true
    containerPort: 514
    servicePort: 514
    hostPort: 514
    protocol: UDP

resources:
  limits:
    cpu: 750m
    memory: 1.5Gi
  requests:
    cpu: 300m
    memory: 512Mi

# Add security context to read protected log files
securityContext:
  privileged: true
  runAsUser: 0

extraVolumes:
  - name: varlog
    hostPath:
      path: /var/log

extraVolumeMounts:
  - name: varlog
    mountPath: /var/log
    readOnly: true

config:
  extensions:
    health_check:
      endpoint: 0.0.0.0:13133
  #   basicauth/logsService:
  #     client_auth:
  #       username: '' # REPLACE ME
  #       password: '' # REPLACE ME

  receivers:
    otlp:
      protocols:
        grpc:
          endpoint: 0.0.0.0:4317
        http:
          endpoint: 0.0.0.0:4318
    
    # Custom kubeletstats receiver with TLS skip verify
    # kubeletstats:
    #   collection_interval: 20s
    #   auth_type: "serviceAccount"
    #   endpoint: "${env:K8S_NODE_NAME}:10250"
    #   insecure_skip_verify: true
    
    # Syslog UDP receiver
    syslog:
      udp:
        listen_address: "0.0.0.0:514"
      protocol: rfc5424
      operators:
        - type: router
          id: route-logs
          routes:
            - output: k8s-format-router
              expr: 'attributes["log.file.path"] matches "^/var/log/pods/"'
            - output: syslog-parser
              expr: 'attributes["log.file.path"] matches "^/var/log/(syslog|auth\\.log|kern\\.log|messages)"'
        # Kubernetes log format router
        - type: router
          id: k8s-format-router
          routes:
            - output: parser-docker
              expr: 'body matches "^\\{"'
            - output: parser-crio
              expr: 'body matches "^[^ Z]+ "'
            - output: parser-containerd
              expr: 'body matches "^[^ Z]+Z"'
        # Syslog zinciri (sadeleştirilmiş)
        - type: regex_parser
          id: syslog-parser
          regex: '^(?P<time>[A-Za-z]+ +[0-9]+ +[0-9]+:[0-9]+:[0-9]+) (?P<host>[^ ]+) (?P<program>[^:]+): (?P<message>.*)$'
          timestamp:
            parse_from: attributes.time
            layout: '%b %d %H:%M:%S'
          time_key: attributes.time
          output: syslog-enrich
          cache:
            size: 1024
        - type: move
          id: syslog-enrich
          from: attributes.message
          to: body
        - type: add
          field: resource["log.source"]
          value: "syslog"
        - type: add
          field: resource["host.name"]
          value: "${env:K8S_NODE_NAME}"
        - type: add
          field: resource["k8s.cluster.name"]
          value: 'k8s-cluster-name'
        - type: add
          field: resource["deployment.environment"]
          value: "kubernetes"
        # Kubernetes zinciri aşağıda devam ediyor (değişmeden)
        # Parse CRI-O format
        - type: regex_parser
          id: parser-crio
          regex: '^(?P<time>[^ Z]+) (?P<stream>stdout|stderr) (?P<logtag>[^ ]*) ?(?P<log>.*)$'
          output: extract_metadata_from_filepath
          timestamp:
            parse_from: attributes.time
            layout_type: gotime
            layout: '2006-01-02T15:04:05.999999999Z07:00'
        # Parse CRI-Containerd format
        - type: regex_parser
          id: parser-containerd
          regex: '^(?P<time>[^ ^Z]+Z) (?P<stream>stdout|stderr) (?P<logtag>[^ ]*) ?(?P<log>.*)$'
          output: extract_metadata_from_filepath
          timestamp:
            parse_from: attributes.time
            layout: '%Y-%m-%dT%H:%M:%S.%LZ'
        # Parse Docker format
        - type: json_parser
          id: parser-docker
          output: extract_metadata_from_filepath
          timestamp:
            parse_from: attributes.time
            layout: '%Y-%m-%dT%H:%M:%S.%LZ'
        - type: move
          from: attributes.log
          to: body
        # Extract metadata from file path
        - type: regex_parser
          id: extract_metadata_from_filepath
          regex: '^.*\/(?P<namespace>[^_]+)_(?P<pod_name>[^_]+)_(?P<uid>[a-f0-9\-]{16,36})\/(?P<container_name>[^\._]+)\/(?P<restart_count>\d+)\.log$'
          parse_from: attributes["log.file.path"]
          cache:
            size: 2048
        # Sadece Kubernetes logları için stream alanını taşı
        - type: move
          from: attributes.stream
          to: attributes["stream"]
        # Rename attributes
        - type: move
          from: attributes["log.file.path"]
          to: resource["filename"]
        - type: move
          from: attributes.container_name
          to: resource["container"]
        - type: move
          from: attributes.namespace
          to: resource["namespace"]
        - type: move
          from: attributes.pod_name
          to: resource["pod"]
        - type: add
          field: resource["cluster"]
          value: 'k8s-cluster-name'  # Buraya kendi cluster adını yazabilirsin
        - type: add
          field: resource["log.source"]
          value: 'syslog'  # veya syslog ise 'syslog' olarak eklenebilir
        - type: add
          field: resource["k8s.cronjob.name"]
          value: ""
        - type: add
          field: resource["k8s.daemonset.name"]
          value: ""
        - type: add
          field: resource["k8s.deployment.name"]
          value: ""
        - type: add
          field: resource["k8s.job.name"]
          value: ""
        - type: add
          field: resource["k8s.node.name"]
          value: "${env:K8S_NODE_NAME}"
        - type: add
          field: resource["k8s.pod.name"]
          value: ""
        - type: add
          field: resource["k8s.replicaset.name"]
          value: ""
        - type: add
          field: resource["k8s.statefulset.name"]
          value: ""
        - type: add
          field: resource["service.instance.id"]
          value: "${env:K8S_NODE_NAME}"
        - type: add
          field: resource["service.name"]
          value: "${env:K8S_NODE_NAME}"
        - type: add
          field: resource["service.namespace"]
          value: "kubernetes"
        - type: add
          field: resource["host"]
          value: "${env:K8S_NODE_NAME}"
        - type: add
          field: resource["program"]
          value: ""

    filelog/syslog:
      include:
        - /var/log/syslog
        - /var/log/auth.log
        - /var/log/messages
        - /var/log/kern.log
      start_at: beginning
      include_file_path: true
      include_file_name: true
      operators:
        - type: add
          id: add-syslog-source
          field: resource["log.source"]
          value: "syslog"

    filelog/pods:
      include:
        - /var/log/pods/*/*/*.log
      start_at: beginning
      include_file_path: true
      include_file_name: true
      operators:
        - type: regex_parser
          id: extract_metadata_from_filepath
          regex: '^/var/log/pods/(?P<namespace>[^_]+)_(?P<pod_name>[^_]+)_(?P<pod_uid>[^/]+)/(?P<container_name>[^/]+)/(?P<file_number>\d+)\.log$'
          parse_from: attributes["log.file.path"]

  processors:
    resource:
      attributes:
        - action: upsert
          key: service.namespace
          from_attribute: "namespace"
        - action: upsert
          key: namespace
          from_attribute: "namespace"
        - action: upsert
          key: pod_name
          from_attribute: "pod_name"
        - action: upsert
          key: container_name
          from_attribute: "container_name"
        - action: upsert
          key: k8s.node.name
          from_attribute: "host.name"
        - action: insert
          key: service.name
          value: "${env:K8S_NODE_NAME}"
        - action: insert
          key: service.instance.id
          value: "${env:K8S_NODE_NAME}"
        - action: insert
          key: deployment.environment
          value: "kubernetes"
        - action: insert
          key: host.name
          value: "${env:K8S_NODE_NAME}"
        - action: insert
          key: log.source
          value: 'syslog'
        - action: insert
          key: k8s.cluster.name
          value: 'k8s-cluster-name'
        - action: insert
          key: program
          value: ""
        - action: insert
          key: cluster
          value: 'k8s-cluster-name'
        - action: insert
          key: collector_source
          value: 'file_reader'
    batch:
      send_batch_max_size: 1024
      send_batch_size: 512
      timeout: 10s
    memory_limiter:
      check_interval: 1s
      limit_mib: 1536
      limit_percentage: 80
      spike_limit_mib: 384
      spike_limit_percentage: 25

  exporters:
    # Doğrudan HTTP formatında Loki Push API
    otlphttp:
      endpoint: "http://loki-gateway.monitoring.svc.cluster.local:80/otlp"
      tls:
        insecure: true
      headers:
        X-Scope-OrgID: "fake"
      retry_on_failure:
        enabled: true
        initial_interval: 5s
        max_interval: 30s
        max_elapsed_time: 300s
      sending_queue:
        enabled: true
        num_consumers: 10
        queue_size: 10000
      timeout: 60s
    # External rsyslog receiver
    syslog:
      network: udp
      endpoint: 172.31.44.132
      protocol: rfc5424

  service:
    extensions:
      - health_check
    pipelines:
      logs/syslog:
        receivers: [filelog/syslog]
        processors: [resource, batch]
        exporters: [otlphttp, syslog]
      logs/pods:
        receivers: [filelog/pods]
        processors: [resource, batch]
        exporters: [otlphttp]
      logs/otlp:
        receivers: [otlp]
        processors: [resource, batch]
        exporters: [otlphttp]
      # metrics:
      #   receivers: [kubeletstats]
      #   processors: [resource]
      #   exporters: [otlp]

tolerations:
  - key: node-role.kubernetes.io/control-plane
    effect: NoSchedule
    operator: Exists
  - key: node-role.kubernetes.io/master
    effect: NoSchedule
    operator: Exists