{{ if eq .input "httpjson" }}
type: httpjson

url: https://www.googleapis.com/admin/reports/v1/activity/users/{{ .user_key }}/applications/saml
json_objects_array: items
split_events_by: events

interval: {{ .interval }}

{{ if .http_client_timeout }}
http_client_timeout: {{ .http_client_timeout }}
{{ end }}

oauth2.provider: google
oauth2.google.jwt_file: {{ .jwt_file }}
oauth2.google.delegated_account: {{ .delegated_account }}
oauth2.scopes:
  - https://www.googleapis.com/auth/admin.reports.audit.readonly

date_cursor.url_field: startTime
date_cursor.initial_interval: {{ .initial_interval }}

pagination.id_field: nextPageToken
pagination.url_field: pageToken

{{ if .proxy_url }}
request.proxy_url: {{ .proxy_url }}
{{ end }}

{{ else if eq .input "file" }}
type: log
paths:
{{ range $i, $path := .paths }}
  - {{$path}}
{{ end }}
exclude_files: [".gz$"]
{{ end }}

tags: {{.tags | tojson}}
publisher_pipeline.disable_host: {{ inList .tags "forwarded" }}

processors:
  - add_fields:
      target: ''
      fields:
        ecs.version: 1.11.0
  - script:
      lang: javascript
      id: gsuite-common
      file: ${path.home}/module/gsuite/config/common.js
  - script:
      lang: javascript
      id: gsuite-saml
      file: ${path.home}/module/gsuite/saml/config/pipeline.js
