## BEGIN SCOP ANSIBLE MANAGED BLOCK ##
<source>
  @type monitor_agent
  bind 0.0.0.0
  port 24220
</source>

<source>
  @type tail
  <parse>
    @type regexp
    expression /^(?<LOG_DT>[^ ]*[ ]{1,2}[^ ]*[ ]{1}[^ ]*) (?<HOST_NM>[^ ]*) (?<SESN_USER_ID>[^:]*): (?<SVR_IPADDR>([0-9]{1,3}\.){3}[0-9]{1,3}) (?<PRCS_ID>[^ ]*) (?<JH_IPADDR>[^ ]*) (?<USER_ID>[^ ]*) (?<PWD>[^ ]*) (?<LOG_DESC>[^$]*)$/
  </parse>
  path /var/log/cmd.log
  pos_file /var/log/td-agent/tmp/scop_cmd_json_log.pos
  tag scop_cmd.log
</source>

<source>
  @type tail
  <parse>
    @type none
  </parse>
  path /var/log/auth.log
  pos_file /var/log/td-agent/tmp/scop_auth_log.pos
  tag scop_cmd.log.auth
</source>

<filter scop_cmd.log>
  @type record_transformer
  enable_ruby true
  <record>
    timestamp ${DateTime.strptime(record["LOG_DT"], "%b %d %H:%M:%S").strftime("%Y-%m-%dT%H:%M:%S.000+0000")}
    DIVISION_CD "X-110"
    PROJECT_UID "d3aca0d1-8e5e-11ee-9a4f-0a4acb7012ee"
    PROJECT_NM "NNFW CICD 서버"
    SVR_ID "i-08b7f0bad205aef06"
    ENV_NM "dev"
    LOG_CTG_CD "command logs"
  </record>
  remove_keys LOG_DT
</filter>

<filter scop_cmd.log.auth>
  @type record_transformer
  enable_ruby true
  <record>
    DIVISION_CD "X-110"
    PROJECT_UID "d3aca0d1-8e5e-11ee-9a4f-0a4acb7012ee"
    PROJECT_NM "NNFW CICD 서버"
    SVR_ID "i-08b7f0bad205aef06"
    ENV_NM "dev"
    LOG_CTG_CD "command logs"
    SVR_IPADDR "10.212.112.107"
  </record>
</filter>

<match scop_cmd.**>
  @type forward
  <server>
    host 10.249.9.164
    port 24224
  </server>
</match>

## END SCOP ANSIBLE MANAGED BLOCK ##
