apiVersion: v1
kind: ConfigMap
metadata:
  name: {{ template "graylog.fullname" . }}
  labels:
{{ include "graylog.metadataLabels" . | indent 4 }}
data:
  log4j2.xml: |-
    <?xml version="1.0" encoding="UTF-8"?>
    <Configuration packages="org.graylog2.log4j" shutdownHook="disable">
        <Appenders>
            <Console name="STDOUT" target="SYSTEM_OUT">
              {{- if .Values.graylog.logInJson }}
                <JsonLayout eventEOL="true" compact="true"/>
              {{- else }}
                <PatternLayout pattern="%d %-7level [%c{1}] - %m - %X%n"/>
              {{- end }}
            </Console>
            <RollingFile name="rolling-file" fileName="/usr/share/graylog/log/server.log" filePattern="/usr/share/graylog/log/server.log.%i.gz">
                <PatternLayout>
                    <Pattern>%d{yyyy-MM-dd'T'HH:mm:ss.SSSXXX} %-5p [%c{1}] %m%n</Pattern>
                </PatternLayout>
                <Policies>
                    <SizeBasedTriggeringPolicy size="50MB"/>
                </Policies>
                <DefaultRolloverStrategy max="10" fileIndex="min"/>
            </RollingFile>
            <!-- Internal Graylog log appender. Please do not disable. This makes internal log messages available via REST calls. -->
            <Memory name="graylog-internal-logs" bufferSize="500"/>
            <!-- Rotate audit logs daily -->
            <RollingFile name="AUDITLOG" fileName="/usr/share/graylog/log/audit.log" filePattern="/usr/share/graylog/log/audit-%d{yyyy-MM-dd}.log.gz">
                <PatternLayout>
                    <Pattern>%d [%c{1}] - %m - %X%n</Pattern>
                </PatternLayout>
                <Policies>
                    <TimeBasedTriggeringPolicy />
                </Policies>
            </RollingFile>
        </Appenders>
        <Loggers>
            <!-- Application Loggers -->
            <Logger name="org.graylog2" level="warn"/>
            <Logger name="com.github.joschi.jadconfig" level="warn"/>
            <!-- This emits a harmless warning for ActiveDirectory every time which we can't work around :( -->
            <Logger name="org.apache.directory.api.ldap.model.message.BindRequestImpl" level="error"/>
            <!-- Prevent DEBUG message about Lucene Expressions not found. -->
            <Logger name="org.elasticsearch.script" level="warn"/>
            <!-- Disable messages from the version check -->
            <Logger name="org.graylog2.periodical.VersionCheckThread" level="off"/>
            <!-- Suppress crazy byte array dump of Drools -->
            <Logger name="org.drools.compiler.kie.builder.impl.KieRepositoryImpl" level="warn"/>
            <!-- Silence chatty natty -->
            <Logger name="com.joestelmach.natty.Parser" level="warn"/>
            <!-- Silence Kafka log chatter -->
            <Logger name="kafka.log.Log" level="warn"/>
            <Logger name="kafka.log.OffsetIndex" level="warn"/>
            <!-- Silence useless session validation messages -->
            <Logger name="org.apache.shiro.session.mgt.AbstractValidatingSessionManager" level="warn"/>
            <Root level="warn">
                <AppenderRef ref="STDOUT"/>
            </Root>
            <!-- Security Loggers -->
          <Logger name="org.graylog2.security.realm.PasswordAuthenticator" level="trace" additivity="false">
                <AppenderRef ref="AUDITLOG"/>
            </Logger>
            <Logger name="org.graylog2.security.realm.AccessTokenAuthenticator" level="trace" additivity="false">
                <AppenderRef ref="AUDITLOG"/>
            </Logger>
            <Logger name="org.graylog2.security.realm.RootAccountRealm" level="trace" additivity="false">
                <AppenderRef ref="AUDITLOG"/>
            </Logger>
            <Logger name="org.graylog2.shared.security.ShiroAuthorizationFilter" level="trace" additivity="false">
                <AppenderRef ref="AUDITLOG"/>
            </Logger>
        </Loggers>
    </Configuration>
  graylog.conf: |-
    node_id_file = /usr/share/graylog/data/journal/node-id
    root_username = {{ .Values.graylog.rootUsername }}
    root_email = {{ .Values.graylog.rootEmail }}
    root_timezone = {{ default "UTC" .Values.graylog.rootTimezone }}
    plugin_dir = /usr/share/graylog/plugin
  {{- $externalUri := include "graylog.url" . }}
  {{- if contains ":2" .Values.graylog.image.repository }}
    rest_listen_uri = http://0.0.0.0:9000/api/
    web_listen_uri = http://0.0.0.0:9000/
  {{- if $externalUri }}
    web_endpoint_uri =  {{ $externalUri }}/api
  {{- end }}
  {{- else }}
    http_bind_address = 0.0.0.0:9000
    {{- if .Values.graylog.tls.enabled }}
    http_enable_tls = true
    http_tls_cert_file = {{ .Values.graylog.tls.certFile }}
    http_tls_key_file = {{ .Values.graylog.tls.keyFile }}
    {{- end }}
    {{- if $externalUri }}
    http_external_uri = {{ $externalUri }}/
    {{- end }}
  {{- end }}
    elasticsearch_hosts = {{ template "graylog.elasticsearch.hosts" . }}
    allow_leading_wildcard_searches = false
    allow_highlighting = false
    output_batch_size = 500
    output_flush_interval = 1
    output_fault_count_threshold = 5
    output_fault_penalty_seconds = 30
    processbuffer_processors = 5
    outputbuffer_processors = 3
    processor_wait_strategy = blocking
    ring_size = 65536
    inputbuffer_ring_size = 65536
    inputbuffer_processors = 2
    inputbuffer_wait_strategy = blocking
    message_journal_enabled = true
    # Do not change `message_journal_dir` location
    message_journal_dir = /usr/share/graylog/data/journal
    lb_recognition_period_seconds = 3
    # Use a replica set instead of a single host
    mongodb_uri = {{ template "graylog.mongodb.uri" . }}
    mongodb_max_connections = {{ default 1000 .Values.graylog.mongodb.maxConnections }}
    mongodb_threads_allowed_to_block_multiplier = 5
    # Email transport
    transport_email_enabled = {{ default false .Values.graylog.transportEmail.enabled }}
    transport_email_hostname = {{ default .Values.graylog.transportEmail.hostname }}
    transport_email_port = {{ default .Values.graylog.transportEmail.port }}
    transport_email_use_auth = {{ default .Values.graylog.transportEmail.useAuth }}
    transport_email_use_tls = {{ default .Values.graylog.transportEmail.useTls }}
    transport_email_use_ssl = {{ default false .Values.graylog.transportEmail.useSsl }}
    transport_email_auth_username = {{ default .Values.graylog.transportEmail.authUsername }}
    transport_email_auth_password = {{ default .Values.graylog.transportEmail.authPassword }}
    transport_email_subject_prefix = {{ default .Values.graylog.transportEmail.subjectPrefix }}
    transport_email_from_email = {{ default .Values.graylog.transportEmail.fromEmail }}
  {{- if $externalUri }}
    transport_email_web_interface_url = {{ $externalUri }}
  {{- end }}
    content_packs_dir = /usr/share/graylog/data/contentpacks
    content_packs_auto_load = grok-patterns.json
    proxied_requests_thread_pool_size = 32
  {{- if .Values.graylog.config }}
{{ .Values.graylog.config | indent 4 }}
  {{- end }}
  entrypoint.sh: |-
    #!/usr/bin/env bash

    export GRAYLOG_HTTP_PUBLISH_URI="{{ template "graylog.formatUrl" (list . "$(hostname -f):9000/") }}"

    GRAYLOG_HOME=/usr/share/graylog
    # Looking for Master IP
    MASTER_IP=`/k8s/kubectl --namespace {{ .Release.Namespace }} get pod -o jsonpath='{range .items[*]}{.metadata.name} {.status.podIP}{"\n"}{end}' -l graylog-role=master --field-selector=status.phase=Running|awk '{print $2}'`
    SELF_IP=`/k8s/kubectl --namespace {{ .Release.Namespace }} get pod $HOSTNAME -o jsonpath='{.status.podIP}'`
    echo "Current master is $MASTER_IP"
    echo "Self IP is $SELF_IP"
    if [[ -z "$MASTER_IP" ]]; then
      echo "Launching $HOSTNAME as master"
      export GRAYLOG_IS_MASTER="true"
      /k8s/kubectl --namespace {{ .Release.Namespace }} label --overwrite pod $HOSTNAME graylog-role="master"
    else
      # When container was recreated or restart, MASTER_IP == SELF_IP, running as master and no need to change label graylog-role="master"
      if [ "$SELF_IP" == "$MASTER_IP" ];then
        export GRAYLOG_IS_MASTER="true"
      else
        # MASTER_IP != SELF_IP, running as coordinating
        echo "Launching $HOSTNAME as coordinating"
        export GRAYLOG_IS_MASTER="false"
        /k8s/kubectl --namespace {{ .Release.Namespace }} label --overwrite pod $HOSTNAME graylog-role="coordinating"
      fi
    fi
    # Download plugins
  {{- if .Values.graylog.plugins }}
    echo "Downloading Graylog Plugins..."
  {{- range .Values.graylog.plugins }}
    echo "Downloading {{ .url }} ..."
    curl -s --location --retry 3 -o ${GRAYLOG_HOME}/plugin/{{ .name }} "{{ .url }}"
  {{- end }}
  {{- end }}
  {{- if .Values.graylog.metrics.enabled }}
    echo "Downloading https://github.com/graylog-labs/graylog-plugin-metrics-reporter/releases/download/3.0.0/metrics-reporter-prometheus-3.0.0.jar ..."
    curl -s --location --retry 3 -o ${GRAYLOG_HOME}/plugin/metrics-reporter-prometheus-3.0.0.jar "https://github.com/graylog-labs/graylog-plugin-metrics-reporter/releases/download/3.0.0/metrics-reporter-prometheus-3.0.0.jar"
  {{- end }}
  {{- if .Values.graylog.geoip.enabled }}
    echo "Downloading Maxmind GeoLite2 ..."
    curl -s --location --retry 3 -o /tmp/GeoLite2-City.tar.gz "{{ .Values.graylog.geoip.mmdbUri }}"
    curlreturn=$?
    if [[ $curlreturn -eq 0 ]]; then
      mkdir -p ${GRAYLOG_HOME}/geoip && cd ${GRAYLOG_HOME}/geoip && tar xvzf /tmp/GeoLite2-City.tar.gz --wildcards "*.mmdb" --strip-components=1 -C ${GRAYLOG_HOME}/geoip && chown -R graylog:graylog ${GRAYLOG_HOME}/geoip
    fi
  {{- end }}
    # Start Graylog
    echo "Starting graylog"
    # Original docker-entrypoint.sh in Graylog Docker will error while executing since you can't chown readonly files in `config`
    # exec /docker-entrypoint.sh graylog
  {{- if or (.Values.graylog.elasticsearch.uriSecretKey) (.Values.graylog.mongodb.uriSecretKey) }}
    # Interpolate
    sed 's/"/\\\"/g;s/.*/echo "&"/e' ${GRAYLOG_HOME}/config/graylog.conf > ${GRAYLOG_HOME}/graylog.conf.subst
  {{- end }}
    echo "Graylog Home ${GRAYLOG_HOME}"
    echo "JVM Options ${GRAYLOG_SERVER_JAVA_OPTS}"
    "${JAVA_HOME}/bin/java" \
      ${GRAYLOG_SERVER_JAVA_OPTS} \
      -jar \
      -Dlog4j.configurationFile=${GRAYLOG_HOME}/config/log4j2.xml \
      -Djava.library.path=${GRAYLOG_HOME}/lib/sigar/ \
      -Dgraylog2.installation_source=docker \
      ${GRAYLOG_HOME}/graylog.jar \
      server \
    {{- if or (.Values.graylog.elasticsearch.uriSecretKey) (.Values.graylog.mongodb.uriSecretKey) }}
      -f ${GRAYLOG_HOME}/graylog.conf.subst
    {{- else }}
      -f ${GRAYLOG_HOME}/config/graylog.conf
    {{- end }}
