input { pipeline { address => "lumberjack_pipeline_lbjk2" } }
 filter {
   if [log_type] == "internal_log" {
     ruby {
             code => "
             require 'json';
             content = event.get('[message]');
             temp = content[/{.+/mi];
             if (!temp.nil? && temp != '') then
               if not(temp.match?(/^((?!(^\d{4}-\d{2}-\d{2})|(^\{\"version)).)*$/)) then
                 data = JSON.parse(temp);
                 if (data) && (data['timestamp'] != nil) then
                   event.set('timestamp', data['timestamp'])
                 end
                 event.set('message', temp)
                 event.set('is_json_event', 'true')
               else
                 log_part = temp.match(/({.*})/m)&.captures&.first
                 multiline_log = temp.sub(/^{.*?}(?=\n|$)/m, '').strip
                 event.set('multiline_log', multiline_log)
                 event.set('message', log_part)
                 event.set('is_json_event', 'true')
               end
             end
             if not(event.get('[is_json_event]') == 'true') then
               event.set('version', '1.2.0')
               event.set('severity', 'info')
               event.set('service_id', 'logstash-server')
               event.set('timestamp', event.get('[@timestamp]'))
               filename = event.get('[filename]');
               if ( !filename.nil? && filename != '') then
                 event.set('[metadata][container_name]' , event.get('[filename]').split('/').last.split('.').first)
               end
             end
             "
       }
     if ![is_json_event]
     {
       mutate {
         add_field => { "[metadata][namespace]" => "${NAMESPACE:UNKNOWN}"}
         add_field => { "[metadata][pod_name]" => "${POD_NAME:UNKNOWN}"}
         add_field => { "[metadata][node_name]" => "${NODE_NAME:UNKNOWN}"}
         add_field => { "[metadata][pod_uid]" => "${POD_UID:UNKNOWN}"}
         remove_field=>["filename"]
         }
     }
     if [is_json_event] {
       json {
           skip_on_invalid_json => true
           source => "message"
           target => "json"
           remove_field=>["message", "kubernetes"]
           }
         if [json][metadata][proc_id] {
           mutate {
             add_field => { "[metadata][proc_id]" => "%{[json][metadata][proc_id]}" }
           }
           }
         if [json][metadata][node_name] {
           mutate {
             add_field => { "[metadata][node_name]" => "%{[json][metadata][node_name]}" }
           }
           }
         if [json][metadata][namespace] {
           mutate {
             add_field => { "[metadata][namespace]" => "%{[json][metadata][namespace]}" }
           }
           }
         if [json][metadata][pod_name] {
           mutate {
             add_field => { "[metadata][pod_name]" => "%{[json][metadata][pod_name]}" }
           }
           }
     if ![timestamp]{
       mutate {
         copy => { "@timestamp" => "timestamp_modified" }
       }
       mutate {
         convert => { "timestamp_modified" => "string" }
       }
       date {
         match => ["timestamp_modified", "ISO8601"]
         target => "timestamp_precision"
       }
       mutate {
         convert => { "timestamp_precision" => "string" }
       }
       mutate {
         gsub => [ "timestamp_precision", "Z", "+00:00" ]
       }
       mutate {
         add_field => {
           "timestamp" => "%{timestamp_precision}"
         }
       }
       mutate {
         remove_field => [ "timestamp_modified" ]
         remove_field => [ "timestamp_precision" ]
       }
     }if ![multiline_log]{
         mutate {
           add_field => { "message" => "%{[json][message]}" }
           }
         }
         else {
           ruby {
             code => '
               event.set("message", event.get("[json][message]") + "\n" + event.get("[multiline_log]"))
             '
           }
         }
         mutate {
           add_field => {
             "service_id" => "%{[json][service_id]}"
             "version" => "%{[json][version]}"
             "[metadata][container_name]" => "%{[json][metadata][container_name]}"
             "severity" => "%{[json][severity]}"
           }
           remove_field => [ "is_json_event", "json", "log_type", "multiline_log" ]
       }
     }
     else {
       mutate {
           remove_field => [ "log_type" ]
       }
     }
     ruby {
       code => '
         multiline_check = event.get("[tags]")
         if multiline_check && multiline_check.include?("multiline") && multiline_check.size == 1
           event.remove("[tags]")
         end
       '
     }
   }
   mutate {
       add_field => {
         "facilityId" => "audit"
       }
     }

   if [message] == "My first beat message"
   or [message] == "My second beat message"
   {
       if [message] == "This message will be excluded in extSE 2" {
         drop{}
       }
   }
   else {
     drop{}
   }
   mutate {
     replace => { "type" => "lumberjack_generated" }
   }
   if [pipeline_data] {
      mutate {
        remove_field => ["pipeline_data"]
      }
    }
 }
 output {
   lumberjack {
     id => "lbjk2"
     hosts => ["ext2-lumberjack-server"]
     codec => "json"
     port => 5044
     ssl_certificate => "/run/secrets/lumberjackOutput-cacerts/trustedcert"
   }
 }