ansible-roles/roles/samba/templates/vector.yml

---
  
sources:
  in_logs_samba:
    type: file
    include:
      - /var/log/samba/json/auth.log
      - /var/log/samba/json/dsdb.log
      - /var/log/samba/json/dsdb_password.log
      - /var/log/samba/json/dsdb_transaction.log

transforms:
  format_logs_samba:
    type: remap
    inputs: ["in_logs_samba"]
    source: |
      .message = string!(.message)
      if (is_json(.message)) {
        .samba = parse_json!(.message)
      }