From f066c658e2550046d3fa1503f266a7499a26ec52 Mon Sep 17 00:00:00 2001
From: jaskaransarkaria <jaskaran.sarkaria@digital.justice.gov.uk>
Date: Tue, 26 Nov 2024 09:34:11 +0000
Subject: [PATCH] =?UTF-8?q?style:=20=F0=9F=92=84=20make=20modsec=20debug?=
 =?UTF-8?q?=20logs=20more=20readable?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 configmap.tf | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/configmap.tf b/configmap.tf
index 8da7ac2..8ee5455 100644
--- a/configmap.tf
+++ b/configmap.tf
@@ -88,6 +88,12 @@ resource "kubernetes_config_map" "fluent-bit-config" {
         Merge_Log_Key       log_processed
         Buffer_Size         5MB
 
+    [FILTER]
+        Name                              parser
+        Parser                            modsec-debug-logs
+        Match                             cp-ingress-modsec-debug.*
+        Key_Name                          log
+
     [FILTER]
         Name                              lua
         Match                             cp-ingress-modsec-stdout.*
@@ -186,7 +192,13 @@ resource "kubernetes_config_map" "fluent-bit-config" {
         Regex ^(?<time>[^ ]+) (?<stream>stdout|stderr) (?<logtag>[^ ]*) (?<log>.*)$
         Time_Key    time
         Time_Format %Y-%m-%dT%H:%M:%S.%L%z
-
+    [PARSER]
+        # https://rubular.com/r/DjPmoX5HnQMesk
+        Name modsec-debug-logs
+        Format regex
+        Regex ^(?<debug_uid>\[\d+\.\d+\]) (?<uri>\[.*\]) (?<log>.*)$
+        Time_Key    time
+        Time_Format %Y-%m-%dT%H:%M:%S.%L%z
     [PARSER]
         Name         generic-json
         Format       json