{{ if eq .input "httpjson" }}

type: httpjson
config_version: "2"
interval: {{ .interval }}

request.method: GET
{{ if .ssl }}
request.ssl: {{ .ssl | tojson }}
{{ end }}
{{ if .proxy_url }}
request.proxy_url: {{ .proxy_url }}
{{ end }}
request.url: "{{ .url }}&orderby=lastseen&direction=asc"
request.transforms:
{{ if .api_token }}
- set:
    target: header.X-RFToken
    value: {{ .api_token }}
- set:
    target: url.params.lastSeen
    value: '[[ .cursor.timestamp ]]'
    default: '([[ formatDate (now (parseDuration "-{{ .first_interval }}")) "2006-01-02T15:04:05.000Z" ]],]'
  {{ end }}
response.split:
  target: body.data.results
cursor:
  timestamp:
    value: '([[ .first_event.timestamps.lastSeen ]],]'

{{ else if eq .input "file" }}

type: log
paths:
{{ range $i, $path := .paths }}
  - {{$path}}
{{ end }}
exclude_files: [".gz$"]

{{ end }}

tags: {{.tags | tojson}}
publisher_pipeline.disable_host: {{ inList .tags "forwarded" }}

processors:
  - decode_json_fields:
      fields: [message]
      target: json
  - fingerprint:
      fields:
        - event.dataset
        - json.entity.id
      target_field: "@metadata._id"
      encoding: base64
  - add_fields:
      target: ''
      fields:
        ecs.version: 1.12.0
  - script:
      lang: javascript
      id: set_opt_type
      source: >
        function process(event) {
            event.Put("@metadata.op_type", "index");
        }
