{{ if eq .input "syslog" }}

type: syslog
protocol.udp:
  host: "{{.syslog_host}}:{{.syslog_port}}"

{{ else if eq .input "file" }}

type: log
paths:
  {{ range $i, $path := .paths }}
- {{$path}}
  {{ end }}
exclude_files: [".gz$"]

{{ end }}

tags: {{.tags | tojson}}
publisher_pipeline.disable_host: {{ inList .tags "forwarded" }}

processors:
  - rename:
      fields:
        - {from: "message", to: "event.original"}
  - decode_cef:
      field: event.original
{{ if .timezone }}
      timezone: '{{ .timezone }}'
{{ end }}
  - community_id:
  - add_fields:
      target: ''
      fields:
        ecs.version: 1.12.0

{{ if .external_zones }}
  - add_fields:
      target: _temp_
      fields:
        external_zones: {{ .external_zones | tojson }}
{{ end }}

{{ if .internal_zones }}
  - add_fields:
      target: _temp_
      fields:
        internal_zones: {{ .internal_zones | tojson }}
{{ end }}