Add airlift log parsing for vector (#553)

## Description

- Adding source for airlift json logging and airlift json transform (Trino)

prerequisite for stackabletech/trino-operator#376




Co-authored-by: Malte Sander <[email protected]>

Author: maltesander

CHANGELOG.md

@@ -4,6 +4,12 @@ All notable changes to this project will be documented in this file.
 
 ## [Unreleased]
 
+### Added
+
+- Added airlift json source and airlift json transform to vector.toml ([#553]).
+
+[#553]: https://github.com/stackabletech/operator-rs/pull/553
+
 ## [0.34.0] - 2023-02-06
 
 ### Added

src/product_logging/framework.rs

@@ -664,6 +664,10 @@ line_delimiter = "\r\n"
 type = "file"
 include = ["{STACKABLE_LOG_DIR}/*/*.py.json"]
 
+[sources.files_airlift]
+type = "file"
+include = ["{STACKABLE_LOG_DIR}/*/*.airlift.json"]
+
 [transforms.processed_files_stdout]
 inputs = ["files_stdout"]
 type = "remap"
@@ -795,6 +799,18 @@ if parsed_event.levelname == "DEBUG" {{
 .message = parsed_event.message
 '''
 
+[transforms.processed_files_airlift]
+inputs = ["files_airlift"]
+type = "remap"
+source = '''
+parsed_event = parse_json!(string!(.message))
+.message = join!(compact([parsed_event.message, parsed_event.stackTrace]), "\n")
+.timestamp = parse_timestamp!(parsed_event.timestamp, "%Y-%m-%dT%H:%M:%S.%fZ")
+.logger = parsed_event.logger
+.level = parsed_event.level
+.thread = parsed_event.thread
+'''
+
 [transforms.extended_logs_files]
 inputs = ["processed_files_*"]
 type = "remap"