setup.ilm.enabled: false
setup.template.enabled: true
setup.template.name: "{{ansible_hostname}}-log"
setup.template.pattern: "{{ansible_hostname}}-log-*"
setup.template.overwrite: true

filebeat.inputs:
- type: log
  enabled: true
  paths:
    - /var/log/auth.log
    - /var/log/caddy.access.log
    - /var/log/messages
    - /usr/local/etc/unbound/unbound.log
  json.add_error_key: true        # Add an error key if JSON parsing fails

processors:
  - decode_json_fields:
      fields: ["msg"]               # Parse the "msg" field (assuming it's a string containing JSON)
      target: "msg"          # The parsed output will be under a new field "msg_parsed"
      overwrite_keys: true          # Optionally overwrite the "msg" field


output.elasticsearch:
  hosts: ["http://log.service:5080"]
  timeout: 10
  path: "/api/default/"
  index: default
  username: "openobserve@unbl.ink"
  password: "{{openobserve_password}}"