apiVersion: v1
kind: ConfigMap
metadata:
  name: audit-log-collector-config
  namespace: observability
data:
  # Fluent Bit's http input derives the record tag from the request URI, so the
  # path a domain's http-log plugin posts to IS its identity here:
  #   POST /catalog -> tag `catalog` -> Loki label domain=catalog
  # Each domain therefore gets its own label without a per-domain output block,
  # and onboarding one is a single ${AUDIT_LOG_ENDPOINT} change on its side.
  #
  # Kong's http-log payload is a JSON object per request and Loki has no
  # endpoint that accepts it directly, so Fluent Bit is the translator between
  # Kong's format and Loki's push API.
  fluent-bit.conf: |
    [SERVICE]
        Flush        1
        Log_Level    info

    [INPUT]
        Name         http
        Listen       0.0.0.0
        Port         8888

    # On-disk audit trail, kept alongside Loki: the switch stays reversible
    # for as long as this output is here.
    [OUTPUT]
        Name         file
        Match        *
        Path         /data
        File         audit.jsonl
        Format       plain

    # Labels stay deliberately low-cardinality — the full Kong record (route,
    # status, latencies, captured bodies) rides in the log line itself and is
    # queryable with LogQL's json parser. `domain` comes from the tag, i.e.
    # from the URI the domain posted to.
    [OUTPUT]
        Name         loki
        Match        *
        Host         loki.observability.svc.cluster.local
        Port         3100
        Labels       job=kong-audit, domain=$TAG
        Label_Keys   $service['name']
        Line_Format  json