From 146264b34d6bc9162bbe8d49938ba2a878f9fe2c Mon Sep 17 00:00:00 2001
From: Mosiur Rahman <connect.mosiur@gmail.com>
Date: Thu, 13 Aug 2026 08:58:10 +0000
Subject: [PATCH] Added different index for cpanel kernel log - Added route,
 added new pipeline, added new processor and sink inside the pipeline also
 denied logs with log_source==kernel.log towards all-log index

---
 .../charts/data-prepper/values.yaml           | 34 ++++++++++++++++++-
 1 file changed, 33 insertions(+), 1 deletion(-)

diff --git a/helm-charts-observability/charts/data-prepper/values.yaml b/helm-charts-observability/charts/data-prepper/values.yaml
index d2e9208..3348dd2 100644
--- a/helm-charts-observability/charts/data-prepper/values.yaml
+++ b/helm-charts-observability/charts/data-prepper/values.yaml
@@ -137,6 +137,7 @@ pipelineConfig:
         - systemLog : '/log_source == "system.syslog"'
         - accessLog : '/log_source == "cpanel.access_log"'
         - auditLog : '/log_source == "audit.audit.log"'
+        - kernelLog: '/log_source == "system.kern.log"'
 
       sink:
         - pipeline:
@@ -152,6 +153,9 @@ pipelineConfig:
         - pipeline:
             name: cpanel-audit-pipeline
         
+        - pipeline:
+            name: cpanel-kernel-pipeline
+        
         - pipeline:
             name: cpanel-all-log
 
@@ -231,12 +235,40 @@ pipelineConfig:
             cert: /usr/share/dataprepper/cert/root-ca.pem
             index: cpanel-audit-log-%{yyyy.MM.dd}
 
+    cpanel-kernel-pipeline:
+      source:
+        pipeline:
+          name: cpanel-log-router
+      processor:
+        - drop_events: 
+            drop_when: '/log_source != "system.kern.log"'
+
+      sink:
+        - opensearch:
+            hosts:
+              - "https://brilliant-opensearch-cluster-master:9200"
+            insecure: false
+            username: logger
+            password: "Enp129s0f0-l0gin"
+            index_type: custom
+            cert: /usr/share/dataprepper/cert/root-ca.pem
+            index: cpanel-kernel-log-%{yyyy.MM.dd}
+
 
     cpanel-all-log:
       source:
         pipeline:
           name: cpanel-log-router
-
+      processor:
+        - drop_events: 
+            drop_when: '/log_source == "audit.audit.log"'
+        - drop_events:
+            drop_when: '/log_source == "system.syslog"'
+        - drop_events:
+            drop_when: '/log_source == "cpanel.access_log"'
+        - drop_events:
+            drop_when: '/log_source == "system.kern.log"'
+            
       sink:
         - opensearch:
             hosts: