{{ if eq .input "httpjson" }}

type: httpjson
interval: {{ .interval }}
request.method: GET
auth.oauth2:
  {{ if .client_id }}
  client.id: {{ .client_id }}
  {{ end }}
  {{ if .client_secret }}
  client.secret: {{ .client_secret }}
  {{ end }}
  {{ if .token_url }}
  token_url: {{ .token_url }}
  {{ end }}
  {{ if .user }}
  user: {{ .user }}
  {{ end }}
  {{ if .password }}
  password: {{ .password }}
  {{ end }}
# Query params will be overwritten by request.transforms from start of the input and 
# it is to indicate that this url is for Logout type of events as cursor stores the url as source.
# Each filebeat input cursor source needs to be uniquely identified with a name.
request.url: {{ .url }}/services/data/v52.0/query?q=logout+rest
{{ if .proxy_url }}
request.proxy_url: {{ .proxy_url }}
{{ end }}
request.transforms:
  - set:
      target: url.params.q
      value: "SELECT Id,CreatedDate,LogDate,LogFile FROM EventLogFile WHERE Interval = 'Hourly' AND EventType = 'Logout' AND LogDate > [[.cursor.last_published_logout]] ORDER BY LogDate ASC NULLS FIRST"
      default: "SELECT Id,CreatedDate,LogDate,LogFile FROM EventLogFile WHERE Interval = 'Hourly' AND EventType = 'Logout' ORDER BY LogDate ASC NULLS FIRST"
response.pagination:
  - set:
      target: url.value
      value: '[[if (ne .last_response.body.done true)]]{{ .url }}[[.last_response.body.nextRecordsUrl]][[end]]'
      fail_on_template_error: true
chain:
  - step:
      request.url: {{ .url }}/services/data/v52.0/sobjects/EventLogFile/$.records[:].Id/LogFile
      request.method: GET
      replace: $.records[:].Id
cursor:
  last_published_logout:
    value: '[[(formatDate ((parseDate .last_event.TIMESTAMP_DERIVED "RFC3339").Add (parseDuration "-1h")))]]'

{{ else if eq .input "file" }}

type: log
paths:
{{ range $i, $path := .paths }}
  - {{$path}}
{{ end }}
exclude_files: [".gz$"]

{{ end }}

tags: {{.tags | tojson}}
publisher_pipeline.disable_host: {{ inList .tags "forwarded" }}

processors:
  - decode_json_fields:
      fields: [message]
      target: "json"
  - add_fields:
      target: ''
      fields:
        ecs.version: 1.12.0
  - add_locale: ~