<filter *.var.log.kolla.*.*.log>
    @type record_transformer
    <record>
        Hostname ${hostname}
        Logger openstack.${tag_parts[4]}
        programname ${tag_parts[5]}
    </record>
</filter>

<filter infra.var.log.kolla.*.*.log>
    @type record_transformer
    <record>
        Logger ${tag_parts[4]}
    </record>
</filter>

<filter infra.*>
    @type record_transformer
    <record>
        Hostname ${hostname}
        programname ${tag_parts[1]}
    </record>
</filter>

{% for item in syslog_facilities | selectattr('enabled') %}
<filter syslog.{{ item.facility }}.**>
    @type record_transformer
    <record>
        programname {{ item.logdir }}
    </record>
</filter>
{% endfor %}

# Rename internal Fluent message field to match other logs. This removes
# all other fields by default, including the original message field. This is
# intended to avoid duplication of the log message. Note that if this step
# is moved to the format folder, then it will applied after the second step
# below which will break the logic.
<filter fluent.**>
    @type parser
    key_name message
    format /^(?<Payload>.*)$/
</filter>

<filter fluent.**>
    @type record_transformer
    <record>
        Hostname "#{Socket.gethostname}"
        programname ${tag_parts[0]}
        log_level ${tag_parts[1]}
    </record>
</filter>
