zulip/puppet/kandra/templates/vector_ses.toml.template.erb

26 lines
818 B
Plaintext

# SES writes all of its logs to a single SQS queue; we consume them,
# batch them, and write them to files in S3 for later analysis.
[sources.ses_logs_sqs]
type = "aws_sqs"
queue_url = "<%= @ses_logs_sqs_url %>"
[transforms.extract_ses_message]
type = "remap"
inputs = ["ses_logs_sqs"]
# SES puts its JSON into the text .Message field of the SQS JSON
# event, which itself is serialized before we get it
source = '''
. = parse_json!(string!(.message)).Message
'''
[sinks.ses_logs_s3]
type = "aws_s3"
inputs = ["extract_ses_message"]
bucket = "<%= @ses_logs_s3_bucket %>"
compression = "gzip"
batch.max_bytes = 10000000 # 100k, before compression
batch.timeout_secs = 300 # ..or 5min, whichever is first
encoding.codec = "text"
key_prefix = "%F/"
storage_class = "STANDARD_IA"