[SERVICE]
    Flush        5
    Daemon       Off
    Log_Level    info
    Parsers_File parsers.conf

# Read from systemd journal - filter for Podman container logs
# Container logs come from conmon process with CONTAINER_NAME field
[INPUT]
    Name            systemd
    Tag             journal.*
    Systemd_Filter  _COMM=conmon
    Read_From_Tail  On
    Strip_Underscores On

# Extract container name for better filtering in Graylog
[FILTER]
    Name          record_modifier
    Match         journal.*
    Record        host {{ ansible_hostname }}
    Record        source podman

# Output to Graylog GELF UDP (local, port 12203)
# Graylog needs a GELF UDP input configured on this port
[OUTPUT]
    Name          gelf
    Match         journal.*
    Host          127.0.0.1
    Port          12203
    Mode          udp
    Gelf_Short_Message_Key MESSAGE
    Gelf_Host_Key host