2022-09-19 01:46:36 +0000 [warn]: parameter 'enable_prune_empty_fields' in <filter **>
  @type viaq_data_model
  enable_prune_empty_fields false
  default_keep_fields CEE,time,@timestamp,aushape,ci_job,collectd,docker,fedora-ci,file,foreman,geoip,hostname,ipaddr4,ipaddr6,kubernetes,level,message,namespace_name,namespace_uuid,offset,openstack,ovirt,pid,pipeline_metadata,rsyslog,service,systemd,tags,testcase,tlog,viaq_msg_id
  keep_empty_fields message
  rename_time true
  pipeline_type collector
  process_kubernetes_events false
  <level>
    name "warn"
    match "Warning|WARN|^W[0-9]+|level=warn|Value:warn|\"level\":\"warn\""
  </level>
  <level>
    name "info"
    match "Info|INFO|^I[0-9]+|level=info|Value:info|\"level\":\"info\""
  </level>
  <level>
    name "error"
    match "Error|ERROR|^E[0-9]+|level=error|Value:error|\"level\":\"error\""
  </level>
  <level>
    name "critical"
    match "Critical|CRITICAL|^C[0-9]+|level=critical|Value:critical|\"level\":\"critical\""
  </level>
  <level>
    name "debug"
    match "Debug|DEBUG|^D[0-9]+|level=debug|Value:debug|\"level\":\"debug\""
  </level>
  <formatter>
    tag "journal.system**"
    type sys_journal
    remove_keys "log,stream,MESSAGE,_SOURCE_REALTIME_TIMESTAMP,__REALTIME_TIMESTAMP,CONTAINER_ID,CONTAINER_ID_FULL,CONTAINER_NAME,PRIORITY,_BOOT_ID,_CAP_EFFECTIVE,_CMDLINE,_COMM,_EXE,_GID,_HOSTNAME,_MACHINE_ID,_PID,_SELINUX_CONTEXT,_SYSTEMD_CGROUP,_SYSTEMD_SLICE,_SYSTEMD_UNIT,_TRANSPORT,_UID,_AUDIT_LOGINUID,_AUDIT_SESSION,_SYSTEMD_OWNER_UID,_SYSTEMD_SESSION,_SYSTEMD_USER_UNIT,CODE_FILE,CODE_FUNCTION,CODE_LINE,ERRNO,MESSAGE_ID,RESULT,UNIT,_KERNEL_DEVICE,_KERNEL_SUBSYSTEM,_UDEV_SYSNAME,_UDEV_DEVNODE,_UDEV_DEVLINK,SYSLOG_FACILITY,SYSLOG_IDENTIFIER,SYSLOG_PID"
  </formatter>
  <formatter>
    tag "kubernetes.var.log.pods.**_eventrouter-** k8s-audit.log** openshift-audit.log** ovn-audit.log**"
    type k8s_json_file
    remove_keys "stream"
    process_kubernetes_events true
  </formatter>
  <formatter>
    tag "kubernetes.var.log.pods**"
    type k8s_json_file
    remove_keys "stream"
  </formatter>
</filter> is not used.
2022-09-19 01:46:36 +0000 [warn]: parameter 'enable_openshift_model' in <filter **>
  @type viaq_data_model
  enable_openshift_model false
  enable_prune_empty_fields false
  rename_time false
  undefined_dot_replace_char "UNUSED"
  elasticsearch_index_prefix_field "viaq_index_name"
  <elasticsearch_index_name>
    enabled true
    tag "kubernetes.var.log.pods.openshift-*_** kubernetes.var.log.pods.default_** kubernetes.var.log.pods.kube-*_** var.log.pods.openshift-*_** var.log.pods.default_** var.log.pods.kube-*_** journal.system** system.var.log**"
    name_type static
    static_index_name "infra-write"
  </elasticsearch_index_name>
  <elasticsearch_index_name>
    enabled true
    tag "linux-audit.log** k8s-audit.log** openshift-audit.log** ovn-audit.log**"
    name_type static
    static_index_name "audit-write"
  </elasticsearch_index_name>
  <elasticsearch_index_name>
    enabled true
    tag "**"
    name_type structured
    static_index_name "app-write"
  </elasticsearch_index_name>
</filter> is not used.
2022-09-19 01:46:36 +0000 [warn]: parameter 'enable_prune_empty_fields' in <filter **>
  @type viaq_data_model
  enable_openshift_model false
  enable_prune_empty_fields false
  rename_time false
  undefined_dot_replace_char "UNUSED"
  elasticsearch_index_prefix_field "viaq_index_name"
  <elasticsearch_index_name>
    enabled true
    tag "kubernetes.var.log.pods.openshift-*_** kubernetes.var.log.pods.default_** kubernetes.var.log.pods.kube-*_** var.log.pods.openshift-*_** var.log.pods.default_** var.log.pods.kube-*_** journal.system** system.var.log**"
    name_type static
    static_index_name "infra-write"
  </elasticsearch_index_name>
  <elasticsearch_index_name>
    enabled true
    tag "linux-audit.log** k8s-audit.log** openshift-audit.log** ovn-audit.log**"
    name_type static
    static_index_name "audit-write"
  </elasticsearch_index_name>
  <elasticsearch_index_name>
    enabled true
    tag "**"
    name_type structured
    static_index_name "app-write"
  </elasticsearch_index_name>
</filter> is not used.