# Filebeat 配置 — 采集后端 JSON 日志 → Elasticsearch
# 天工智能体平台 ELK 日志聚合

filebeat.inputs:
  # ── 后端 JSON 应用日志 ──
  - type: log
    enabled: true
    paths:
      - /app/logs/app.json.log
    json.keys_under_root: true
    json.add_error_key: true
    json.overwrite_keys: true
    fields:
      service: backend
      log_type: application
    fields_under_root: true

  # ── Celery Worker 日志 ──
  - type: log
    enabled: true
    paths:
      - /app/logs/celery*.log
    multiline.pattern: '^\d{4}-\d{2}-\d{2}'
    multiline.negate: true
    multiline.match: after
    fields:
      service: celery
      log_type: application
    fields_under_root: true

  # ── Uvicorn 访问日志 ──
  - type: log
    enabled: true
    paths:
      - /app/logs/uvicorn.log
    fields:
      service: uvicorn
      log_type: access
    fields_under_root: true

output.elasticsearch:
  hosts: ["http://elasticsearch:9200"]
  index: "aiagent-logs-%{+yyyy.MM.dd}"
  worker: 1
  bulk_max_size: 200

# Index template
setup.template.name: "aiagent-logs"
setup.template.pattern: "aiagent-logs-*"
setup.template.settings:
  index.number_of_shards: 1
  index.number_of_replicas: 0
  index.refresh_interval: 5s

# 日志记录
logging.level: info
logging.to_files: true
logging.files:
  path: /var/log/filebeat
  name: filebeat.log
  keepfiles: 3