Added different index for cpanel kernel log - Added route, added new pipeline, added new processor and sink inside the pipeline also denied logs with log_source==kernel.log towards all-log index

helm-charts-observability/charts/data-prepper/values.yaml

@@ -137,6 +137,7 @@ pipelineConfig:
         - systemLog : '/log_source == "system.syslog"'
         - accessLog : '/log_source == "cpanel.access_log"'
         - auditLog : '/log_source == "audit.audit.log"'
+        - kernelLog: '/log_source == "system.kern.log"'
 
       sink:
         - pipeline:
@@ -152,6 +153,9 @@ pipelineConfig:
         - pipeline:
             name: cpanel-audit-pipeline
         
+        - pipeline:
+            name: cpanel-kernel-pipeline
+        
         - pipeline:
             name: cpanel-all-log
 
@@ -231,12 +235,40 @@ pipelineConfig:
             cert: /usr/share/dataprepper/cert/root-ca.pem
             index: cpanel-audit-log-%{yyyy.MM.dd}
 
+    cpanel-kernel-pipeline:
+      source:
+        pipeline:
+          name: cpanel-log-router
+      processor:
+        - drop_events: 
+            drop_when: '/log_source != "system.kern.log"'
+
+      sink:
+        - opensearch:
+            hosts:
+              - "https://brilliant-opensearch-cluster-master:9200"
+            insecure: false
+            username: logger
+            password: "Enp129s0f0-l0gin"
+            index_type: custom
+            cert: /usr/share/dataprepper/cert/root-ca.pem
+            index: cpanel-kernel-log-%{yyyy.MM.dd}
+
 
     cpanel-all-log:
       source:
         pipeline:
           name: cpanel-log-router
-
+      processor:
+        - drop_events: 
+            drop_when: '/log_source == "audit.audit.log"'
+        - drop_events:
+            drop_when: '/log_source == "system.syslog"'
+        - drop_events:
+            drop_when: '/log_source == "cpanel.access_log"'
+        - drop_events:
+            drop_when: '/log_source == "system.kern.log"'
+            
       sink:
         - opensearch:
             hosts: