#
# Cookbook:: irrigate-fluentd
# Recipe:: cloudtrail
#
# Copyright: The Orchard
#

packages = %w(
  openssl-devel
  make
  automake
  gcc
  gcc-c++
  kernel-devel
)

packages.each do |name|
  package name
end

td_agent_source 'cloudtrail' do
  type 's3'
  tag 'cloudtrail'
  parameters(
    s3_region: node['fluentd']['aws_region'],
    s3_bucket: node['fluentd']['cloudtrail_bucket'],
    format: 'json',
    '<sqs>': "\nqueue_name #{node['fluentd']['sqs_queue']}\n</sqs>"
  )
end

td_agent_match 'cloudtrail_split' do
  type 'record_splitter'
  tag 'cloudtrail'
  parameters(
    split_key: 'Records',
    keep_other_key: 'true',
    tag: 'cloudtrail.record'
  )
end

td_agent_filter 'cloudtrail_filter' do
  type 'record_transformer'
  tag 'cloudtrail.*'
  parameters(record: [{ log_type: 'cloudtrail' }])
end

# vim: ts=2 sw=2 sts=2 et