From f0635a2e8aafa9c18691ae43261e21f66055821f Mon Sep 17 00:00:00 2001
From: Kazuhiro MUSASHI <simoom634@yahoo.co.jp>
Date: Sat, 4 Mar 2023 15:24:53 +0900
Subject: [PATCH] Deploy `vector` config for `journald`.

---
 .../systemd/system/vector-journald.service    | 16 +++++
 .../vector/files/etc/vector/journald.toml     | 62 +++++++++++++++++++
 cookbooks/vector/setup.rb                     | 21 +++++++
 3 files changed, 99 insertions(+)
 create mode 100644 cookbooks/vector/files/etc/systemd/system/vector-journald.service
 create mode 100644 cookbooks/vector/files/etc/vector/journald.toml

diff --git a/cookbooks/vector/files/etc/systemd/system/vector-journald.service b/cookbooks/vector/files/etc/systemd/system/vector-journald.service
new file mode 100644
index 0000000..d985ecf
--- /dev/null
+++ b/cookbooks/vector/files/etc/systemd/system/vector-journald.service
@@ -0,0 +1,16 @@
+[Unit]
+Description=Vector
+Documentation=https://vector.dev
+After=network-online.target
+Requires=network-online.target
+
+[Service]
+ExecStart=/usr/bin/vector --config /etc/vector/journald.toml
+ExecReload=/bin/kill -HUP $MAINPID
+Restart=always
+StandardOutput=journal
+StandardError=journal
+SyslogIdentifier=vector
+
+[Install]
+WantedBy=multi-user.target
diff --git a/cookbooks/vector/files/etc/vector/journald.toml b/cookbooks/vector/files/etc/vector/journald.toml
new file mode 100644
index 0000000..7bb62f4
--- /dev/null
+++ b/cookbooks/vector/files/etc/vector/journald.toml
@@ -0,0 +1,62 @@
+data_dir = "/var/lib/vector/"
+
+[sources.journald]
+  type = "journald"
+  exclude_units = [
+      "prometheus",
+      "consul",
+      "cron",
+      "snmp_exporter",
+  ]
+
+  [sources.journald.exclude_matches]
+  "SYSLOG_IDENTIFIER" = [ "kernel", "vector", "sudo", "vault" ]
+
+[transforms.journald_transform]
+  type = "remap"
+  inputs = ["journald"]
+  source = '''
+    .hostname = .host
+    del(.host)
+
+    .SYSLOG_FACILITY = to_int!(.SYSLOG_FACILITY)
+    .SYSLOG_FACILITY = to_syslog_facility!(.SYSLOG_FACILITY)
+
+    .PRIORITY = to_int!(.PRIORITY)
+    .PRIORITY = to_syslog_level!(.PRIORITY)
+
+    .SYSLOG_IDENTIFIER = downcase!(.SYSLOG_IDENTIFIER)
+
+    .job = replace!(._SYSTEMD_UNIT, r'(\.service|\.scope)', "")
+  '''
+
+[sinks.journald_output]
+type = "file"
+inputs = [ "journald_transform" ]
+compression = "none"
+path = "/tmp/journald-%Y-%m-%d.log"
+
+  [sinks.journald_output.encoding]
+  codec = "json"
+
+  [sinks.journald_output.buffer]
+  max_size = 268435488
+  type = "disk"
+
+[sinks.journald_loki]
+type = "loki"
+inputs = [ "journald_transform" ]
+endpoint = "http://loki.service.consul:3100"
+compression = "snappy"
+
+  [sinks.journald_loki.labels]
+  level = "{{ PRIORITY }}"
+  hostname = "{{ hostname }}"
+  job = "{{ job }}"
+
+  [sinks.journald_loki.encoding]
+  codec = "json"
+
+  [sinks.journald_loki.buffer]
+  max_size = 268435488
+  type = "disk"
diff --git a/cookbooks/vector/setup.rb b/cookbooks/vector/setup.rb
index f3c48d3..637c0df 100644
--- a/cookbooks/vector/setup.rb
+++ b/cookbooks/vector/setup.rb
@@ -70,6 +70,27 @@ service 'vector-consul' do
   action [:enable, :start]
 end
 
+# Deploy config for mointoring `journald`:
+remote_file '/etc/vector/journald.toml' do
+  owner 'root'
+  group 'root'
+  mode  '0644'
+
+  notifies :restart, 'service[vector-journald]'
+end
+
+remote_file '/etc/systemd/system/vector-journald.service' do
+  owner 'root'
+  group 'root'
+  mode  '0644'
+
+  notifies :restart, 'service[vector-journald]'
+end
+
+service 'vector-journald' do
+  action [:enable, :start]
+end
+
 # Stop vector default service:
 service 'vector' do
   action :disable