[SERVICE]
    Flush         5
    Log_Level     info
    Parsers_File  /fluent-bit/etc/custom_parsers.conf
    storage.path  /fluent-bit/db/buffer

# ---------------------------------------------------------------------------
# INPUT: every container's json-file log on this Docker host
# ---------------------------------------------------------------------------
[INPUT]
    Name              tail
    Tag               docker.*
    Path              /var/lib/docker/containers/*/*-json.log
    multiline.parser  docker
    DB                /fluent-bit/db/tail.db
    storage.type      filesystem
    Mem_Buf_Limit     20MB
    Skip_Long_Lines   On
    Refresh_Interval  10
    Rotate_Wait       30

# Apps that log JSON (e.g. ForkFolio via Pino) get their fields lifted to the
# top level. Non-JSON lines fail to parse and are kept unchanged in "log".
[FILTER]
    Name          parser
    Match         docker.*
    Key_Name      log
    Parser        app_json
    Reserve_Data  On
    Preserve_Key  Off

# Route by the container's logging "tag" option (docker-compose: logging.options.tag).
# A container tagged "forkfolio" becomes "app.forkfolio". Untagged containers
# keep their docker.* tag and are dropped unless the catch-all output is enabled.
[FILTER]
    Name          rewrite_tag
    Match         docker.*
    Rule          $attrs['tag'] ^([A-Za-z0-9_-]+)$ app.$1 false
    Emitter_Name  app_router
    Emitter_Storage.type filesystem

# ---------------------------------------------------------------------------
# OUTPUTS: one per app -> its own OpenObserve stream
# To add an app: set logging.options.tag in its compose file, then copy this
# block and change Match (app.<tag>) and the stream name in URI.
# ---------------------------------------------------------------------------
[OUTPUT]
    Name              http
    Match             app.forkfolio
    Host              ${ZO_HOST}
    Port              ${ZO_PORT}
    URI               /api/${ZO_ORG}/forkfolio/_json
    Format            json
    Json_date_key     _timestamp
    Json_date_format  iso8601
    HTTP_User         ${ZO_ROOT_USER_EMAIL}
    HTTP_Passwd       ${ZO_ROOT_USER_PASSWORD}
    compress          gzip
    Retry_Limit       10

# Optional catch-all: uncomment to ship logs from untagged containers to a
# shared "docker" stream (includes OpenObserve's and Fluent Bit's own logs).
# [OUTPUT]
#     Name              http
#     Match             docker.*
#     Host              ${ZO_HOST}
#     Port              ${ZO_PORT}
#     URI               /api/${ZO_ORG}/docker/_json
#     Format            json
#     Json_date_key     _timestamp
#     Json_date_format  iso8601
#     HTTP_User         ${ZO_ROOT_USER_EMAIL}
#     HTTP_Passwd       ${ZO_ROOT_USER_PASSWORD}
#     compress          gzip
#     Retry_Limit       10