{{ if eq .input "httpjson" }}

type: httpjson
interval: {{ .interval }}

request.method: POST
{{ if .ssl }}
request.ssl: {{ .ssl | tojson }}
{{ end }}
{{ if .proxy_url }}
request.proxy_url: {{ .proxy_url }}
{{ end }}
request.url: {{ .url }}
request.body:
{{ if .filters }}
  {{ .filters | tojson}}
{{ end }}
request.transforms:
{{ if .api_token }}
- set:
    target: header.Authorization
    value: {{ .api_token }}
{{ end }}
- set:
    target: body.page
    value: 1
- set:
    target: body.limit
    value: 10
- set:
    target: body.returnFormat
    value: json
- set:
    target: body.timestamp
    value: '[[.cursor.timestamp]]'
    default: '[[ formatDate (now (parseDuration "-{{ .first_interval }}")) "UnixDate" ]]'

response.split:
  target: body.response
  split:
    target: body.Event.Attribute
    ignore_empty_value: true
    keep_parent: true
    split:
      target: body.Event.Object
      keep_parent: true
      split:
        target: body.Event.Object.Attribute
        keep_parent: true
response.request_body_on_pagination: true
response.pagination:
- set:
    target: body.page
    value: '[[if (ne (len .last_response.body.response) 0)]][[add .last_response.page 1]][[end]]'
    fail_on_template_error: true
cursor:
  timestamp:
    value: '[[.last_event.Event.timestamp]]'


{{ else if eq .input "file" }}

type: log
paths:
{{ range $i, $path := .paths }}
  - {{$path}}
{{ end }}
exclude_files: [".gz$"]

{{ end }}

tags:
{{if .preserve_original_event}}
  - preserve_original_event
{{end}}
{{range $val := .tags}}
  - {{$val}}
{{end}}

publisher_pipeline.disable_host: {{ inList .tags "forwarded" }}

processors:
  - add_locale: ~
  - add_fields:
      target: ''
      fields:
        ecs.version: 1.12.0