package { ['httparty','retries']:
  ensure   => present,
  provider => 'puppet_gem',
}

graylog_api { 'api':
  username => 'admin',
  password => $password,
  port     => 9000,
  tls      => false,
  server   => 'localhost'
}

graylog_index_set { 'graylog':
  description                => 'The Graylog default index set',
  display_name               => 'Default index set',
  shards                     => 1,
  replicas                   => 0,
  rotation_strategy          => 'size',
  rotation_strategy_details  => {
    max_size => '10 GB'.to_bytes,
  },
  retention_strategy         => 'delete',
  retention_strategy_details => {
    max_number_of_indices => 10,
  },
}

# Default properties are often acceptable
graylog_api::input::gelf_tcp { 'A GELF TCP Input': }

# But you can customize if you want
graylog_api::input::gelf_tcp { 'A GELF TCP Input with TLS':
  port          => 12202,
  tls_cert_file => '/etc/graylog/server/tls/cert.pem',
  tls_enable    => true,
  tls_key_file  => '/etc/graylog/server/tls/key.pem',
}

# Load a single pattern
graylog_grok_pattern { 'SOMEFORMAT':
  pattern => '%{WORD:username} %{IP:ipaddress} %{GREEDYDATA:message}',
}

# Or load a bunch of patterns from a pattern file
graylog_api::grok::pattern_file { 'common patterns':
  content => file('profile/graylog/patterns/common),
}

# First set up some rules
graylog_api::pipeline::rule { 'copy message to full_message':
  description => 'Copy the message field to the full_message field before performing extraction',
  condition   => 'has_field("message") && has_field("log_format") && !has_field("full_message")',
  action      => 'set_field("full_message",$message.message);',
}

graylog_api::pipeline::rule { 'parse log format':
  description => 'Parse log via GROK if log_format field is provided',
  condition   => 'has_field("log_format")',
  action      => @(END_OF_ACTION),
                 let format_name = uppercase(to_string($message.log_format));
                 let pattern = concat(concat("%{",format_name),"}");
                 let map = grok(pattern: pattern, value: to_string($message.message), only_named_captures: true);
                 remove_field("log_format");
                 set_fields(map);
                 |-END_OF_ACTION
}

# Then put those rules in a pipeline
graylog_api::pipeline { 'custom log formats':
  description       => "Parse custom log formats",
  stages            => [
    'copy message to full_message',
    'parse log format'
  ],
  connected_streams => ['All messages'],
}