datadog:
  apiKey: "<datadog_api_key>"
  pipelineId: "<observability_pipelines_configuration_id>"
  site: "datadoghq.com"

env:
  - name: SPLUNK_HEC_ENDPOINT
    value: <https://your.splunk.index:8088/>
  - name: SPLUNK_TOKEN
    value: <a_random_token_usually_a_uuid>

## Autoscaling
##
autoscaling:
  enabled: true
  minReplicas: 2
  targetCPUUtilizationPercentage: 80

podDisruptionBudget:
  enabled: true
  minAvailable: 1

## HorizontalPodAutoscaler (HPA) requires resource requests to function,
## so this example configures several default values. Datadog recommends
## that you change the values to match the actual size of instances that
## you are using.
resources:
  requests:
    cpu: 1000m
    memory: 512Mi

affinity:
  ## To prevent a single datacenter from causing a complete system failure,
  ## this example defaults to running pods in different availability zones.
  podAntiAffinity:
    preferredDuringSchedulingIgnoredDuringExecution:
      - weight: 100
        podAffinityTerm:
          labelSelector:
            matchExpressions:
              - key: app.kubernetes.io/name
                operator: In
                values:
                  - observability-pipelines-worker
          topologyKey: topology.kubernetes.io/zone


## Load Balancing
## This example configuration avoids cross-availability-zone costs where possible.
service:
  enabled: true
  type: "LoadBalancer"
  externalTrafficPolicy: "Local"
  annotations:
    networking.gke.io/load-balancer-type: "Internal"
    cloud.google.com/load-balancer-type: "Internal" # for older GKE versions
    networking.gke.io/internal-load-balancer-allow-global-access: "true"


## Buffering
## This creates an EBS drive that can be used for buffers, which
## must then be configured in the sinks themselves.
persistence:
  enabled: true
  storageClassName: "premium-rwo"
  accessModes:
    - ReadWriteOnce
  size: 288Gi


## Observability Pipelines (OP) Configuration
## This is a sample configuration that Datadog recommends for
## getting started with OP. It sets up data proxying and provides hooks
## for your own processing steps.
pipelineConfig:
  sources:
    splunk_receiver:
      type: splunk_hec
      address: 0.0.0.0:8088
      valid_tokens:
          - ${SPLUNK_TOKEN}

  transforms:
    ## This is a placeholder for your own remap (or other transform)
    ## steps with tags set up. Datadog recommends these tag assignments.
    ## They show which data has been moved over to OP and what still needs
    ## to be moved.
    logs_enrich:
      type: remap
      inputs:
        - splunk_receiver
      source: |
        .sender = "observability_pipelines_worker"
        .opw_aggregator = get_hostname!()

  ## This buffer configuration is split into 144GB buffers for both of the Datadog and Splunk sinks.
  ##
  ## This should work for the vast majority of OP Worker deployments and should rarely
  ## need to be adjusted. If you do change it, be sure to update the size of the persistence
  ## block above.
  ##
  ## The "${DD_API_KEY}" parameter is automatically replaced by the API
  ## key you entered in the `datadog` section at the top of this file.
  ##
  ## The "${SPLUNK_HEC_ENDPOINT}" and "${SPLUNK_TOKEN}" parameters are automatically replaced
  ## by the settings configured in the `env` section above this config.
  sinks:
    datadog_logs:
      type: datadog_logs
      inputs:
        - logs_enrich
      default_api_key: "${DD_API_KEY}"
      site: "${DD_SITE}"
      compression: gzip
      buffer:
          type: disk
          max_size: 150323855359
    splunk_logs:
      type: splunk_hec_logs
      inputs:
        - logs_enrich
      endpoint: ${SPLUNK_HEC_ENDPOINT}
      default_token: ${SPLUNK_TOKEN}
      encoding:
        codec: json
      buffer:
          type: disk
          max_size: 150323855359
