##############################################################
# GMLM Platform — Promtail Configuration
#
# Promtail is the log shipping agent. It reads log files
# from the filesystem and Docker container outputs, attaches
# structured labels, and ships everything to Loki.
#
# Labels attached to every log line:
#   deployment  — identifies the customer deployment
#   environment — production / staging
#   service     — which component logged it (app, horizon, nginx)
#   channel     — Laravel log channel (security, commission, updater)
#   level       — log severity (warning, error, critical)
#
# In Grafana, these labels become filterable dimensions:
#   {deployment="acme-mlm", channel="security", level="error"}
##############################################################

server:
  http_listen_port: 9080
  grpc_listen_port: 0

positions:
  filename: /tmp/positions.yaml  # Tracks read position across restarts

clients:
  - url: http://loki:3100/loki/api/v1/push

scrape_configs:

  # ── GMLM Application Logs ────────────────────────────────────
  - job_name: gmlm_application
    static_configs:
      - targets:
          - localhost
        labels:
          deployment:  ${DEPLOYMENT_ID:-production}
          environment: ${APP_ENV:-production}
          service:     app
          __path__:    /gmlm/logs/gmlm-*.log

    pipeline_stages:
      # Parse JSON log format (set in config/logging.php)
      - json:
          expressions:
            level:      level
            channel:    channel
            message:    message
            context:    context
            request_id: extra.request_id
            user_id:    extra.user_id
            url:        extra.url
            version:    extra.platform_version

      # Promote parsed fields as Loki labels
      - labels:
          level:
          channel:
          version:

      # Drop debug logs in production (too noisy)
      - match:
          selector: '{environment="production", level="debug"}'
          action: drop

      # Set the log timestamp from the JSON field
      - timestamp:
          source: datetime
          format: RFC3339

  # ── Security Audit Logs ──────────────────────────────────────
  - job_name: gmlm_security
    static_configs:
      - targets:
          - localhost
        labels:
          deployment:  ${DEPLOYMENT_ID:-production}
          environment: ${APP_ENV:-production}
          service:     security
          channel:     security
          __path__:    /gmlm/logs/security.log

    pipeline_stages:
      - json:
          expressions:
            level:   level
            message: message
            user_id: extra.user_id
            ip:      extra.ip
      - labels:
          level:
      - match:
          selector: '{channel="security", level=~"warning|error|critical"}'
          stages:
            - metrics:
                security_events_total:
                  type: Counter
                  description: "Total security events"
                  source: level
                  config:
                    action: inc

  # ── Commission Audit Logs ────────────────────────────────────
  - job_name: gmlm_commissions
    static_configs:
      - targets:
          - localhost
        labels:
          deployment:  ${DEPLOYMENT_ID:-production}
          environment: ${APP_ENV:-production}
          service:     app
          channel:     commission
          __path__:    /gmlm/logs/commissions.log

    pipeline_stages:
      - json:
          expressions:
            level:   level
            message: message
      - labels:
          level:

  # ── Update Engine Logs ───────────────────────────────────────
  - job_name: gmlm_updater
    static_configs:
      - targets:
          - localhost
        labels:
          deployment:  ${DEPLOYMENT_ID:-production}
          service:     updater
          channel:     updater
          __path__:    /gmlm/logs/updates.log

    pipeline_stages:
      - json:
          expressions:
            level:   level
            message: message
      - labels:
          level:

  # ── Docker Container Logs ────────────────────────────────────
  # Ships stdout/stderr from all GMLM containers
  - job_name: gmlm_containers
    docker_sd_configs:
      - host: unix:///var/run/docker.sock
        refresh_interval: 15s
        filters:
          - name:   label
            values: ['com.docker.compose.project=gmlm-${DEPLOYMENT_ID:-production}']

    relabel_configs:
      # Use container name as service label
      - source_labels: [__meta_docker_container_name]
        regex:         /gmlm-(.+)
        target_label:  service
        replacement:   '$1'

      - source_labels: [__meta_docker_container_label_com_docker_compose_service]
        target_label:  compose_service

      # Ignore monitoring containers (they log to themselves)
      - source_labels: [__meta_docker_container_name]
        regex:         /gmlm-(prometheus|grafana|loki|promtail|alertmanager).*
        action: drop

    pipeline_stages:
      - json:
          expressions:
            log:    log
            stream: stream
            time:   time
      - labels:
          stream:
      - output:
          source: log
