apiVersion: logging.openshift.io/v1
kind: ClusterLogForwarder
metadata:
  name: instance
  namespace: openshift-logging
spec:
  inputs:
  - application:
      containerLimit:
        maxRecordsPerSecond: 0
      namespaces:
      - test-project-1
      - test-project-2
    name: limited-rates-1
  - application:
      namespaces:
      - test-project-3
      - test-project-4
    name: app-logs
  - application:
      containerLimit:
        maxRecordsPerSecond: 10
      namespaces:
      - test-project-5
    name: limited-rates-2
  pipelines:
  - inputRefs:
    - limited-rates-1
    - limited-rates-2
    - app-logs
    - infrastructure
    name: to-default
    outputRefs:
    - default 

[transforms.route_application_logs]
type = "route"
inputs = ["application"]
route.app-logs = '(.kubernetes.namespace_name == "test-project-3") || (.kubernetes.namespace_name == "test-project-4")'
route.limited-rates-1 = '(.kubernetes.namespace_name == "test-project-1") || (.kubernetes.namespace_name == "test-project-2")'
route.limited-rates-2 = '.kubernetes.namespace_name == "test-project-5"'




[transforms.source_throttle_limited-rates-2]
type = "throttle"
inputs = ["route_application_logs.limited-rates-2"]
window_secs = 1
threshold = 10
key_field = "{{ file }}"


[transforms.to_default_user_defined]
type = "remap"
inputs = ["route_application_logs.limited-rates-1","source_throttle_limited-rates-2","route_application_logs.app-logs","infrastructure"]
source = '''
  .
''' 

$ oc exec elasticsearch-cdm-g46bh9kz-1-788c868978-tz4dl -- es_util --query=app*/_count?pretty -d '{"query": {"match_phrase": {"kubernetes.namespace_name": "test-project-1"}}}'
Defaulted container "elasticsearch" out of: elasticsearch, proxy
{
  "count" : 73033,
  "_shards" : {
    "total" : 3,
    "successful" : 3,
    "skipped" : 0,
    "failed" : 0
  }
}
$ oc exec elasticsearch-cdm-g46bh9kz-1-788c868978-tz4dl -- es_util --query=app*/_count?pretty -d '{"query": {"match_phrase": {"kubernetes.namespace_name": "test-project-2"}}}'
Defaulted container "elasticsearch" out of: elasticsearch, proxy
{
  "count" : 72423,
  "_shards" : {
    "total" : 3,
    "successful" : 3,
    "skipped" : 0,
    "failed" : 0
  }
}