{{ if eq .input "httpjson" }}

type: httpjson
interval: {{ .interval }}

{{ if .client_id }}
auth.basic.user: {{ .client_id }}
{{ end }}
{{ if .api_key }}
auth.basic.password: {{ .api_key }}
{{ end }}

request.url: {{ .url }}
request.method: GET
request.timeout: {{ .request_timeout }}
{{ if .ssl }}
request.ssl: {{ .ssl | tojson }}
{{ end }}
{{ if .proxy_url }}
request.proxy_url: {{ .proxy_url }}
{{ end }}
request.transforms:
- set:
    target: url.params.start_date
    value: '[[.cursor.timestamp]]'
    default: '[[ formatDate (now (parseDuration "-{{ .first_interval }}")) "2006-01-02T15:04:05-07:00" ]]'
- set:
    target: url.params.limit
    value: {{ .limit }}
request.rate_limit.limit: '[[ .last_response.header.Get "X-Rate-Limit-Limit" ]]'
request.rate_limit.early_limit: 1
request.rate_limit.reset: '[[ add (toInt (.last_response.header.Get "X-Rate-Limit-Reset")) ((now).Unix) ]]'
request.rate_limit.remaining: '[[ .last_response.header.Get "X-Rate-Limit-Remaining" ]]'

response.split:
  target: body.data
  keep_parent: true

response.pagination:
- set:
    target: url.value
    value: '[[ .last_response.body.metadata.links.next ]]'
    fail_on_template_error: true

cursor:
  timestamp:
    value: '[[ .first_event.data.date ]]'

{{ else if eq .input "file" }}

type: log
paths:
{{ range $i, $path := .paths }}
  - {{$path}}
{{ end }}
exclude_files: [".gz$"]

{{ end }}


tags: {{.tags | tojson}}
publisher_pipeline.disable_host: {{ inList .tags "forwarded" }}

processors:
  - decode_json_fields:
      fields: [message]
      target: json
  - fingerprint:
      fields:
        - "json.data.timestamp"
        - "json.data.timestamp_nanoseconds"
        - "json.data.event_type_id"
        - "json.data.connector_guid"
        - "json.data.id"
        - "json.data.detection_id"
      target_field: "@metadata._id"
      ignore_missing: true
  - add_fields:
      target: ''
      fields:
        ecs.version: 1.12.0