# =============================================================================
# SOURCES: Woher kommen die Daten?
# =============================================================================
sources:
  docker_logs:
    type: docker_logs

# =============================================================================
# TRANSFORMS: Verarbeitung der Daten
# =============================================================================
transforms:
  # Schritt 1: Nur bestimmte Level durchlassen
  filter_debug:
    type: filter
    inputs: [docker_logs]
    condition: 'includes(["INFO", "WARN", "ERROR"], .level)'

  # Schritt 2: Die gefilterten Logs formatieren (VRL)
  parse_logs:
    type: remap
    inputs: [filter_debug] # Nimmt den Input vom Filter, nicht von der Source!
    source: |
      .message = replace(.message, "\n", "")
      .service = "my-cluster"

# =============================================================================
# SINKS: Wohin sollen die Daten?
# =============================================================================
sinks:
  stdout_debug:
    type: console
    inputs: [parse_logs]
    encoding:
      codec: json