# docker/logstash/bugsink.conf
# ============================================================================
# Logstash Pipeline Configuration for Bugsink Error Tracking
# ============================================================================
# This configuration aggregates logs from multiple sources and forwards errors
# to Bugsink (Sentry-compatible error tracking) in the dev container.
#
# Sources:
#   - PM2 managed logs (/var/log/pm2/*.log) - API, Worker, Vite (ADR-014)
#   - Pino application logs (/app/logs/*.log) - JSON format (fallback)
#   - PostgreSQL logs (/var/log/postgresql/*.log) - Including fn_log() output
#   - NGINX logs (/var/log/nginx/*.log) - Access and error logs
#   - Redis logs (/var/log/redis/*.log) - Via shared volume (ADR-050)
#
# Bugsink Projects (3-project architecture):
#   - Project 1: Backend API (Dev) - Pino/PM2 app errors, PostgreSQL errors
#     DSN Key: cea01396c56246adb5878fa5ee6b1d22
#   - Project 2: Frontend (Dev) - Configured via Sentry SDK in browser
#     DSN Key: d92663cb73cf4145b677b84029e4b762
#   - Project 4: Infrastructure (Dev) - Redis, NGINX, PM2 operational logs
#     DSN Key: 14e8791da3d347fa98073261b596cab9
#
# Routing Logic:
#   - Backend logs (type: pm2_api, pm2_worker, pino, postgres) -> Project 1
#   - Infrastructure logs (type: redis, nginx_error, nginx_5xx) -> Project 4
#   - Vite errors (type: pm2_vite with errors) -> Project 4 (build tooling)
#
# Related Documentation:
#   - docs/adr/0050-postgresql-function-observability.md
#   - docs/adr/0015-application-performance-monitoring-and-error-tracking.md
#   - docs/operations/LOGSTASH-QUICK-REF.md
# ============================================================================

input {
  # ============================================================================
  # PM2 Managed Process Logs (ADR-014, ADR-050)
  # ============================================================================
  # PM2 manages all Node.js processes in the dev container, matching production.
  # Logs are written to /var/log/pm2 for Logstash integration.
  #
  # Process logs:
  #   - api-out.log / api-error.log: API server (Pino JSON format)
  #   - worker-out.log / worker-error.log: Background worker (Pino JSON format)
  #   - vite-out.log / vite-error.log: Vite dev server (plain text)
  # ============================================================================

  # PM2 API Server Logs (Pino JSON format)
  file {
    path => "/var/log/pm2/api-out.log"
    codec => json_lines
    type => "pm2_api"
    tags => ["app", "backend", "pm2", "api"]
    start_position => "beginning"
    sincedb_path => "/var/lib/logstash/sincedb_pm2_api_out"
  }

  file {
    path => "/var/log/pm2/api-error.log"
    codec => json_lines
    type => "pm2_api"
    tags => ["app", "backend", "pm2", "api", "stderr"]
    start_position => "beginning"
    sincedb_path => "/var/lib/logstash/sincedb_pm2_api_error"
  }

  # PM2 Worker Logs (Pino JSON format)
  file {
    path => "/var/log/pm2/worker-out.log"
    codec => json_lines
    type => "pm2_worker"
    tags => ["app", "worker", "pm2"]
    start_position => "beginning"
    sincedb_path => "/var/lib/logstash/sincedb_pm2_worker_out"
  }

  file {
    path => "/var/log/pm2/worker-error.log"
    codec => json_lines
    type => "pm2_worker"
    tags => ["app", "worker", "pm2", "stderr"]
    start_position => "beginning"
    sincedb_path => "/var/lib/logstash/sincedb_pm2_worker_error"
  }

  # PM2 Vite Logs (plain text format)
  file {
    path => "/var/log/pm2/vite-out.log"
    codec => plain
    type => "pm2_vite"
    tags => ["app", "frontend", "pm2", "vite"]
    start_position => "beginning"
    sincedb_path => "/var/lib/logstash/sincedb_pm2_vite_out"
  }

  file {
    path => "/var/log/pm2/vite-error.log"
    codec => plain
    type => "pm2_vite"
    tags => ["app", "frontend", "pm2", "vite", "stderr"]
    start_position => "beginning"
    sincedb_path => "/var/lib/logstash/sincedb_pm2_vite_error"
  }

  # ============================================================================
  # Pino Application Logs (Fallback Path)
  # ============================================================================
  # JSON-formatted logs from the Node.js application using Pino logger.
  # Note: Primary logs now go to /var/log/pm2. This is a fallback.
  # Log levels: 10=trace, 20=debug, 30=info, 40=warn, 50=error, 60=fatal
  file {
    path => "/app/logs/*.log"
    codec => json
    type => "pino"
    tags => ["app", "backend"]
    start_position => "beginning"
    sincedb_path => "/var/lib/logstash/sincedb_pino"
  }

  # ============================================================================
  # PostgreSQL Function Logs (ADR-050)
  # ============================================================================
  # Captures PostgreSQL log output including fn_log() structured JSON messages.
  # PostgreSQL is configured to write logs to /var/log/postgresql/ (shared volume).
  # Log format: "2026-01-22 14:30:00 PST [5724] postgres@flyer_crawler_dev LOG: message"
  # Note: Timestamps are in PST (America/Los_Angeles) timezone as configured in compose.dev.yml
  file {
    path => "/var/log/postgresql/*.log"
    type => "postgres"
    tags => ["postgres", "database"]
    start_position => "beginning"
    sincedb_path => "/var/lib/logstash/sincedb_postgres"
  }

  # ============================================================================
  # NGINX Logs
  # ============================================================================
  # Access logs for request monitoring and error logs for proxy/SSL issues.
  file {
    path => "/var/log/nginx/access.log"
    type => "nginx_access"
    tags => ["nginx", "access"]
    start_position => "beginning"
    sincedb_path => "/var/lib/logstash/sincedb_nginx_access"
  }

  file {
    path => "/var/log/nginx/error.log"
    type => "nginx_error"
    tags => ["nginx", "error"]
    start_position => "beginning"
    sincedb_path => "/var/lib/logstash/sincedb_nginx_error"
  }

  # ============================================================================
  # Redis Logs (ADR-050)
  # ============================================================================
  # Redis logs from the shared volume. Redis uses its own log format:
  # "<pid>:<role> <day> <month> <time> <loglevel> <message>"
  # Example: "1:M 22 Jan 2026 14:30:00.123 * Ready to accept connections"
  # Log levels: . (debug), - (verbose), * (notice), # (warning)
  file {
    path => "/var/log/redis/redis-server.log"
    type => "redis"
    tags => ["redis", "infra"]
    start_position => "beginning"
    sincedb_path => "/var/lib/logstash/sincedb_redis"
  }
}

filter {
  # ============================================================================
  # PM2 API/Worker Log Processing (ADR-014)
  # ============================================================================
  # PM2 API and Worker logs are in Pino JSON format.
  # Process them the same way as direct Pino logs.
  if [type] in ["pm2_api", "pm2_worker"] {
    # Tag errors (level 50 = error, 60 = fatal)
    if [level] >= 50 {
      mutate { add_tag => ["error", "pm2_pino_error"] }

      # Map Pino level to Sentry level and set error_message field
      if [level] == 60 {
        mutate { add_field => { "sentry_level" => "fatal" } }
      } else {
        mutate { add_field => { "sentry_level" => "error" } }
      }

      # Copy msg to error_message for consistent access in output
      mutate { add_field => { "error_message" => "%{msg}" } }
    }
  }

  # ============================================================================
  # PM2 Vite Log Processing (ADR-014)
  # ============================================================================
  # Vite logs are plain text. Look for error patterns.
  if [type] == "pm2_vite" {
    # Detect Vite build/compilation errors
    if [message] =~ /(?i)(error|failed|exception|cannot|enoent|eperm|EACCES|ECONNREFUSED)/ {
      mutate { add_tag => ["error", "vite_error"] }
      mutate { add_field => { "sentry_level" => "error" } }
      mutate { add_field => { "error_message" => "Vite: %{message}" } }
    }
  }

  # ============================================================================
  # Pino Log Processing (Fallback)
  # ============================================================================
  if [type] == "pino" {
    # Tag errors (level 50 = error, 60 = fatal)
    if [level] >= 50 {
      mutate { add_tag => ["error", "pino_error"] }

      # Map Pino level to Sentry level and set error_message field
      if [level] == 60 {
        mutate { add_field => { "sentry_level" => "fatal" } }
      } else {
        mutate { add_field => { "sentry_level" => "error" } }
      }

      # Copy msg to error_message for consistent access in output
      mutate { add_field => { "error_message" => "%{msg}" } }
    }
  }

  # ============================================================================
  # PostgreSQL Log Processing (ADR-050)
  # ============================================================================
  # PostgreSQL log format in dev container:
  # "2026-01-22 14:30:00 PST [5724] postgres@flyer_crawler_dev LOG: message"
  # "2026-01-22 15:06:03 PST [19851] postgres@flyer_crawler_dev ERROR: column "id" does not exist"
  # Note: Timestamps are in PST (America/Los_Angeles) timezone
  if [type] == "postgres" {
    # Parse PostgreSQL log prefix with timezone (PST in dev, may vary in prod)
    grok {
      match => { "message" => "%{YEAR}-%{MONTHNUM}-%{MONTHDAY} %{TIME} %{WORD:pg_timezone} \[%{POSINT:pg_pid}\] %{DATA:pg_user}@%{DATA:pg_database} %{WORD:pg_level}:  ?%{GREEDYDATA:pg_message}" }
      tag_on_failure => ["_postgres_grok_failure"]
    }

    # Check if this is a structured JSON log from fn_log()
    if [pg_message] =~ /^\{.*"source":"postgresql".*\}$/ {
      json {
        source => "pg_message"
        target => "fn_log"
      }

      # Mark as error if level is WARNING or ERROR
      if [fn_log][level] in ["WARNING", "ERROR"] {
        mutate { add_tag => ["error", "db_function"] }
        mutate { add_field => { "sentry_level" => "warning" } }
        if [fn_log][level] == "ERROR" {
          mutate { replace => { "sentry_level" => "error" } }
        }
        # Use fn_log message for error_message
        mutate { add_field => { "error_message" => "%{[fn_log][message]}" } }
      }
    }

    # Catch native PostgreSQL errors (ERROR: or FATAL: prefix in pg_level)
    if [pg_level] == "ERROR" or [pg_level] == "FATAL" {
      mutate { add_tag => ["error", "postgres_native"] }

      if [pg_level] == "FATAL" {
        mutate { add_field => { "sentry_level" => "fatal" } }
      } else {
        mutate { add_field => { "sentry_level" => "error" } }
      }

      # Use the full pg_message for error_message
      mutate { add_field => { "error_message" => "PostgreSQL %{pg_level}: %{pg_message}" } }
    }
  }

  # ============================================================================
  # NGINX Access Log Processing
  # ============================================================================
  if [type] == "nginx_access" {
    grok {
      match => { "message" => '%{IPORHOST:client_ip} - %{DATA:user} \[%{HTTPDATE:timestamp}\] "%{WORD:method} %{URIPATHPARAM:request} HTTP/%{NUMBER:http_version}" %{NUMBER:status} %{NUMBER:bytes} "%{DATA:referrer}" "%{DATA:user_agent}"' }
      tag_on_failure => ["_nginx_access_grok_failure"]
    }

    # Tag 5xx errors for Bugsink
    if [status] =~ /^5/ {
      mutate { add_tag => ["error", "nginx_5xx"] }
      mutate { add_field => { "sentry_level" => "error" } }
      mutate { add_field => { "error_message" => "HTTP %{status} %{method} %{request}" } }
    }
  }

  # ============================================================================
  # NGINX Error Log Processing
  # ============================================================================
  # NGINX error log format: "2026/01/22 17:55:01 [error] 16#16: *3 message..."
  if [type] == "nginx_error" {
    grok {
      match => { "message" => "%{YEAR}/%{MONTHNUM}/%{MONTHDAY} %{TIME} \[%{LOGLEVEL:nginx_level}\] %{POSINT:pid}#%{POSINT}: (\*%{POSINT:connection} )?%{GREEDYDATA:nginx_message}" }
      tag_on_failure => ["_nginx_error_grok_failure"]
    }

    # Only process actual errors, not notices (like "signal process started")
    if [nginx_level] in ["error", "crit", "alert", "emerg"] {
      mutate { add_tag => ["error", "nginx_error"] }

      # Map NGINX log level to Sentry level
      if [nginx_level] in ["crit", "alert", "emerg"] {
        mutate { add_field => { "sentry_level" => "fatal" } }
      } else {
        mutate { add_field => { "sentry_level" => "error" } }
      }

      mutate { add_field => { "error_message" => "NGINX [%{nginx_level}]: %{nginx_message}" } }
    }
  }

  # ============================================================================
  # Redis Log Processing (ADR-050)
  # ============================================================================
  # Redis log format: "<pid>:<role> <day> <month> <time>.<ms> <level> <message>"
  # Example: "1:M 22 Jan 14:30:00.123 * Ready to accept connections"
  # Roles: M=master, S=slave, C=sentinel, X=cluster
  # Levels: . (debug), - (verbose), * (notice), # (warning)
  if [type] == "redis" {
    # Parse Redis log format
    grok {
      match => { "message" => "%{POSINT:redis_pid}:%{WORD:redis_role} %{MONTHDAY} %{MONTH} %{YEAR}? ?%{TIME} %{DATA:redis_level_char} %{GREEDYDATA:redis_message}" }
      tag_on_failure => ["_redis_grok_failure"]
    }

    # Map Redis level characters to human-readable levels
    # . = debug, - = verbose, * = notice, # = warning
    if [redis_level_char] == "#" {
      mutate {
        add_field => { "redis_level" => "warning" }
        add_tag => ["error", "redis_warning"]
      }
      mutate { add_field => { "sentry_level" => "warning" } }
      mutate { add_field => { "error_message" => "Redis WARNING: %{redis_message}" } }
    } else if [redis_level_char] == "*" {
      mutate { add_field => { "redis_level" => "notice" } }
    } else if [redis_level_char] == "-" {
      mutate { add_field => { "redis_level" => "verbose" } }
    } else if [redis_level_char] == "." {
      mutate { add_field => { "redis_level" => "debug" } }
    }

    # Also detect error keywords in message content (e.g., ECONNREFUSED, OOM, etc.)
    if [redis_message] =~ /(?i)(error|failed|refused|denied|timeout|oom|crash|fatal|exception)/ {
      if "error" not in [tags] {
        mutate { add_tag => ["error", "redis_error"] }
        mutate { add_field => { "sentry_level" => "error" } }
        mutate { add_field => { "error_message" => "Redis ERROR: %{redis_message}" } }
      }
    }
  }

  # ============================================================================
  # Generate Sentry Event ID and Ensure Required Fields for all errors
  # ============================================================================
  # CRITICAL: sentry_level MUST be set for all errors before output.
  # Bugsink's PostgreSQL schema limits level to varchar(7), so valid values are:
  #   fatal, error, warning, info, debug (all <= 7 chars)
  # If sentry_level is not set, the literal "%{sentry_level}" (16 chars) is sent,
  # causing PostgreSQL insertion failures.
  # ============================================================================
  if "error" in [tags] {
    # Use Ruby for robust field handling - handles all edge cases
    ruby {
      code => '
        require "securerandom"

        # Generate unique event ID for Sentry
        event.set("sentry_event_id", SecureRandom.hex(16))

        # =====================================================================
        # CRITICAL: Validate and set sentry_level
        # =====================================================================
        # Valid Sentry levels (max 7 chars for Bugsink PostgreSQL schema):
        #   fatal, error, warning, info, debug
        # Default to "error" if missing, empty, or invalid.
        # =====================================================================
        valid_levels = ["fatal", "error", "warning", "info", "debug"]
        current_level = event.get("sentry_level")

        if current_level.nil? || current_level.to_s.strip.empty? || !valid_levels.include?(current_level.to_s.downcase)
          event.set("sentry_level", "error")
        else
          # Normalize to lowercase
          event.set("sentry_level", current_level.to_s.downcase)
        end

        # =====================================================================
        # Ensure error_message has a fallback value
        # =====================================================================
        error_msg = event.get("error_message")
        if error_msg.nil? || error_msg.to_s.strip.empty?
          fallback_msg = event.get("message") || event.get("msg") || "Unknown error"
          event.set("error_message", fallback_msg.to_s)
        end
      '
    }
  }
}

output {
  # ============================================================================
  # Forward Errors to Bugsink (Project Routing)
  # ============================================================================
  # Bugsink uses Sentry-compatible API. Events must include:
  #   - event_id: 32 hex characters (UUID without dashes)
  #   - message: Human-readable error description
  #   - level: fatal, error, warning, info, debug
  #   - timestamp: Unix epoch in seconds
  #   - platform: "node" for backend, "javascript" for frontend
  #
  # Authentication via X-Sentry-Auth header with project's public key.
  #
  # Project Routing:
  #   - Project 1 (Backend): Pino app logs, PostgreSQL errors
  #   - Project 4 (Infrastructure): Redis, NGINX, Vite build errors
  # ============================================================================

  # ============================================================================
  # Infrastructure Errors -> Project 4
  # ============================================================================
  # Redis warnings/errors, NGINX errors, and Vite build errors go to
  # the Infrastructure project for separation from application code errors.
  if "error" in [tags] and ([type] == "redis" or [type] == "nginx_error" or [type] == "nginx_access" or [type] == "pm2_vite") {
    http {
      url => "http://localhost:8000/api/4/store/"
      http_method => "post"
      format => "json"
      headers => {
        "X-Sentry-Auth" => "Sentry sentry_key=14e8791da3d347fa98073261b596cab9, sentry_version=7"
        "Content-Type" => "application/json"
      }
      mapping => {
        "event_id" => "%{sentry_event_id}"
        "timestamp" => "%{@timestamp}"
        "level" => "%{sentry_level}"
        "platform" => "other"
        "logger" => "%{type}"
        "message" => "%{error_message}"
        "extra" => {
          "hostname" => "%{[host][name]}"
          "source_type" => "%{type}"
          "tags" => "%{tags}"
          "original_message" => "%{message}"
          "project" => "infrastructure"
        }
      }
    }
  }

  # ============================================================================
  # Backend Application Errors -> Project 1
  # ============================================================================
  # Pino application logs (API, Worker), PostgreSQL function errors, and
  # native PostgreSQL errors go to the Backend API project.
  else if "error" in [tags] and ([type] in ["pm2_api", "pm2_worker", "pino", "postgres"]) {
    http {
      url => "http://localhost:8000/api/1/store/"
      http_method => "post"
      format => "json"
      headers => {
        "X-Sentry-Auth" => "Sentry sentry_key=cea01396c56246adb5878fa5ee6b1d22, sentry_version=7"
        "Content-Type" => "application/json"
      }
      mapping => {
        "event_id" => "%{sentry_event_id}"
        "timestamp" => "%{@timestamp}"
        "level" => "%{sentry_level}"
        "platform" => "node"
        "logger" => "%{type}"
        "message" => "%{error_message}"
        "extra" => {
          "hostname" => "%{[host][name]}"
          "source_type" => "%{type}"
          "tags" => "%{tags}"
          "original_message" => "%{message}"
          "project" => "backend"
        }
      }
    }
  }

  # ============================================================================
  # Fallback: Any other errors -> Project 1
  # ============================================================================
  # Catch-all for any errors that don't match specific routing rules.
  else if "error" in [tags] {
    http {
      url => "http://localhost:8000/api/1/store/"
      http_method => "post"
      format => "json"
      headers => {
        "X-Sentry-Auth" => "Sentry sentry_key=cea01396c56246adb5878fa5ee6b1d22, sentry_version=7"
        "Content-Type" => "application/json"
      }
      mapping => {
        "event_id" => "%{sentry_event_id}"
        "timestamp" => "%{@timestamp}"
        "level" => "%{sentry_level}"
        "platform" => "node"
        "logger" => "%{type}"
        "message" => "%{error_message}"
        "extra" => {
          "hostname" => "%{[host][name]}"
          "source_type" => "%{type}"
          "tags" => "%{tags}"
          "original_message" => "%{message}"
          "project" => "backend-fallback"
        }
      }
    }
  }

  # ============================================================================
  # Store Operational Logs to Files (for debugging/audit)
  # ============================================================================
  # NGINX access logs (all requests, not just errors)
  if [type] == "nginx_access" and "error" not in [tags] {
    file {
      path => "/var/log/logstash/nginx-access-%{+YYYY-MM-dd}.log"
      codec => json_lines
    }
  }

  # PostgreSQL operational logs (non-error)
  if [type] == "postgres" and "error" not in [tags] {
    file {
      path => "/var/log/logstash/postgres-operational-%{+YYYY-MM-dd}.log"
      codec => json_lines
    }
  }

  # Redis operational logs (non-error)
  if [type] == "redis" and "error" not in [tags] {
    file {
      path => "/var/log/logstash/redis-operational-%{+YYYY-MM-dd}.log"
      codec => json_lines
    }
  }

  # PM2 API operational logs (non-error) - ADR-014
  if [type] == "pm2_api" and "error" not in [tags] {
    file {
      path => "/var/log/logstash/pm2-api-%{+YYYY-MM-dd}.log"
      codec => json_lines
    }
  }

  # PM2 Worker operational logs (non-error) - ADR-014
  if [type] == "pm2_worker" and "error" not in [tags] {
    file {
      path => "/var/log/logstash/pm2-worker-%{+YYYY-MM-dd}.log"
      codec => json_lines
    }
  }

  # PM2 Vite operational logs (non-error) - ADR-014
  if [type] == "pm2_vite" and "error" not in [tags] {
    file {
      path => "/var/log/logstash/pm2-vite-%{+YYYY-MM-dd}.log"
      codec => json_lines
    }
  }

  # ============================================================================
  # Debug Output (for development only)
  # ============================================================================
  # Uncomment to see all processed events in Logstash stdout
  # stdout { codec => rubydebug }
}