Deploy `vector` config for `unattended-upgrades-dpkg.log`.

cookbooks/vector/files/etc/systemd/system/vector-unattended-upgrade.service

@@ -0,0 +1,17 @@
+[Unit]
+Description=Vector
+Documentation=https://vector.dev
+After=network-online.target
+Requires=network-online.target
+
+[Service]
+ExecStart=/usr/bin/vector --config /etc/vector/unattended-upgrade.toml
+ExecReload=/bin/kill -HUP $MAINPID
+Restart=always
+StandardOutput=journal
+StandardError=journal
+SyslogIdentifier=vector
+
+[Install]
+WantedBy=multi-user.target
+

cookbooks/vector/files/etc/vector/unattended-upgrade.toml

@@ -0,0 +1,50 @@
+data_dir = "/var/lib/vector/"
+
+[sources.unattended-upgrade]
+  type = "file"
+  include = [ "/var/log/unattended-upgrades/unattended-upgrades.log" ]
+  ignore_older_secs = 600
+  read_from = "beginning"
+
+[transforms.unattended-upgrade_transform]
+  type = "remap"
+  inputs = ["unattended-upgrade"]
+  source = '''
+    parse = parse_regex(.message, r'^(?P<timestamp>\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}), \d{3} (?P<level>[^ ]+) (?P<message>.+)$') ?? {}
+    . = merge(., parse)
+
+    .hostname = .host
+    del(.host)
+  '''
+
+[sinks.unattended-upgrade_output]
+type = "file"
+inputs = [ "unattended-upgrade_transform" ]
+compression = "none"
+path = "/tmp/unattended-upgrade-%Y-%m-%d.log"
+
+  [sinks.unattended-upgrade_output.encoding]
+  codec = "json"
+
+  [sinks.unattended-upgrade_output.buffer]
+  max_size = 268435488
+  type = "disk"
+
+[sinks.unattended-upgrade_loki]
+type = "loki"
+inputs = [ "unattended-upgrade_transform" ]
+endpoint = "http://loki.service.consul:3100"
+compression = "snappy"
+
+  [sinks.unattended-upgrade_loki.labels]
+  level = "notice"
+  hostname = "{{ hostname }}"
+  job = "unattended-upgrade"
+  filename = "{{ file }}"
+
+  [sinks.unattended-upgrade_loki.encoding]
+  codec = "json"
+
+  [sinks.unattended-upgrade_loki.buffer]
+  max_size = 268435488
+  type = "disk"

cookbooks/vector/setup.rb

@@ -91,6 +91,27 @@ service 'vector-journald' do
   action [:enable, :start]
 end
 
+# Deploy config for mointoring `/var/log/unattended-upgrades/unattended-upgrades-dpkg.log`:
+remote_file '/etc/vector/unattended-upgrade.toml' do
+  owner 'root'
+  group 'root'
+  mode  '0644'
+
+  notifies :restart, 'service[vector-unattended-upgrade]'
+end
+
+remote_file '/etc/systemd/system/vector-unattended-upgrade.service' do
+  owner 'root'
+  group 'root'
+  mode  '0644'
+
+  notifies :restart, 'service[vector-unattended-upgrade]'
+end
+
+service 'vector-unattended-upgrade' do
+  action [:enable, :start]
+end
+
 # Stop vector default service:
 service 'vector' do
   action :disable