<match kolla.var.log.kolla.*.*.log>
    @type rewrite_tag_filter
    capitalize_regex_backreference yes
  <rule>
    key     programname
    pattern ^(cinder-api-access|cloudkitty-api-access|gnocchi-api-access|horizon-access|keystone-apache-admin-access|keystone-apache-public-access|monasca-api-access|monasca-log-api-access|placement-api-access|panko-api-access)$
    tag apache_access
  </rule>
  <rule>
    key     programname
    pattern ^(aodh_wsgi_access|barbican-api|zun_api_wsgi_access|vitrage_wsgi_access)$
    tag wsgi_access
  </rule>
  <rule>
    key     programname
    pattern ^(nova-api|nova-compute|nova-compute-ironic|nova-conductor|nova-consoleauth|nova-manage|nova-novncproxy|nova-scheduler|nova-placement-api|placement-api|privsep-helper)$
    tag openstack_python
  </rule>
  <rule>
    key     programname
    pattern ^(sahara-api|sahara-engine)$
    tag openstack_python
  </rule>
  <rule>
    key     programname
    pattern ^(neutron-server|neutron-openvswitch-agent|neutron-ns-metadata-proxy|neutron-metadata-agent|neutron-l3-agent|neutron-dhcp-agent)$
    tag openstack_python
  </rule>
  <rule>
    key     programname
    pattern ^(magnum-conductor|magnum-api)$
    tag openstack_python
  </rule>
  <rule>
    key     programname
    pattern ^(keystone)$
    tag openstack_python
  </rule>
  <rule>
    key     programname
    pattern ^(heat-engine|heat-api|heat-api-cfn)$
    tag openstack_python
  </rule>
  <rule>
    key     programname
    pattern ^(glance-api)$
    tag openstack_python
  </rule>
  <rule>
    key     programname
    pattern ^(cloudkitty-storage-init|cloudkitty-processor|cloudkitty-dbsync|cloudkitty-api)$
    tag openstack_python
  </rule>
  <rule>
    key     programname
    pattern ^(ceilometer-polling|ceilometer-agent-notification)$
    tag openstack_python
  </rule>
  <rule>
    key     programname
    pattern ^(barbican-worker|barbican-keystone-listener|barbican-db-manage|app)$
    tag openstack_python
  </rule>
  <rule>
    key     programname
    pattern ^(aodh-notifier|aodh-listener|aodh-evaluator|aodh-dbsync)$
    tag openstack_python
  </rule>
  <rule>
    key     programname
    pattern ^(cyborg-api|cyborg-conductor|cyborg-agent)$
    tag openstack_python
  </rule>
  <rule>
    key     programname
    pattern ^(cinder-api|cinder-scheduler|cinder-manage|cinder-volume|cinder-backup|privsep-helper)$
    tag openstack_python
  </rule>
  <rule>
    key     programname
    pattern ^(mistral-server)$
    tag openstack_python
  </rule>
  <rule>
    key     programname
    pattern ^(designate-api|designate-central|designate-manage|designate-mdns|designate-sink|designate-worker)$
    tag openstack_python
  </rule>
  <rule>
    key     programname
    pattern ^(manila-api|manila-data|manila-manage|manila-share|manila-scheduler)$
    tag openstack_python
  </rule>
  <rule>
    key     programname
    pattern ^(trove-api|trove-conductor|trove-manage|trove-taskmanager)$
    tag openstack_python
  </rule>
  <rule>
    key     programname
    pattern ^(congress-server)$
    tag openstack_python
  </rule>
  <rule>
    key     programname
    pattern ^(murano-api|murano-engine)$
    tag openstack_python
  </rule>
  <rule>
    key     programname
    pattern ^(senlin-api|senlin-engine)$
    tag openstack_python
  </rule>
  <rule>
    key     programname
    pattern ^(watcher-api|watcher-applier|watcher-db-manage|watcher-decision-engine)$
    tag openstack_python
  </rule>
  <rule>
    key     programname
    pattern ^(freezer-api|freezer-api_access|freezer-manage)$
    tag openstack_python
  </rule>
  <rule>
    key     programname
    pattern ^(octavia-api|octavia-health-manager|octavia-housekeeping|octavia-worker)$
    tag openstack_python
  </rule>
  <rule>
    key     programname
    pattern ^(zun-api|zun-compute)$
    tag openstack_python
  </rule>
  <rule>
    key     programname
    pattern ^(kuryr-server)$
    tag openstack_python
  </rule>
  <rule>
    key     programname
    pattern ^(gnocchi-api|gnocchi-statsd|gnocchi-metricd|gnocchi-upgrade)$
    tag openstack_python
  </rule>
  <rule>
    key     programname
    pattern ^(ironic-api|ironic-conductor|ironic-inspector)$
    tag openstack_python
  </rule>
  <rule>
    key     programname
    pattern ^(panko-api|panko-dbsync)$
    tag openstack_python
  </rule>
  <rule>
    key     programname
    pattern ^(tacker-server|tacker-conductor)$
    tag openstack_python
  </rule>
  <rule>
    key     programname
    pattern ^(vitrage-ml|vitrage-notifier|vitrage-graph)$
    tag openstack_python
</rule>
  <rule>
    key     programname
    pattern ^(blazar-api|blazar-manager)$
    tag openstack_python
  </rule>
  <rule>
    key     programname
    pattern ^(monasca-api|monasca-notification|monasca-persister|agent-collector|agent-forwarder|agent-statsd)$
    tag openstack_python
  </rule>
  <rule>
    key     programname
    pattern .+
    tag unmatched
  </rule>
</match>

# Retag log messages from MariaDB according to log format
<match infra.mariadb>
  @type rewrite_tag_filter
  <rule>
    key Payload
    pattern /^\d{6}/
    tag infra.mariadb.mysqld_safe
  </rule>
  <rule>
    key Payload
    pattern /^\d{4}-\d{2}-\d{2}/
    tag infra.mariadb.mysqld
  </rule>
</match>
