{{ if eq .input "httpjson" }}
type: httpjson
interval: {{ .interval }}
auth.oauth2.provider: google
auth.oauth2.google.jwt_file: {{ .jwt_file }}
auth.oauth2.google.delegated_account: {{ .delegated_account }}
auth.oauth2.scopes:
  - https://www.googleapis.com/auth/admin.reports.audit.readonly
request.url: https://www.googleapis.com/admin/reports/v1/activity/users/{{ .user_key }}/applications/user_accounts
{{ if .http_client_timeout }}
request.timeout: {{ .http_client_timeout }}
{{ end }}
{{ if .proxy_url }}
request.proxy_url: {{ .proxy_url }}
{{ end }}
request.transforms:
  - set:
      target: url.params.startTime
      value: '[[if eq .last_response.page 0]][[.cursor.last_execution_datetime]][[else]][[.last_response.url.params.Get "startTime"]][[end]]'
      default: '[[formatDate (now (parseDuration "-{{.initial_interval}}"))]]'
response.split:
  target: body.items
  split:
    target: body.events
    keep_parent: true
response.pagination:
  - set:
      target: url.params.pageToken
      value: "[[.last_response.body.nextPageToken]]"
      fail_on_template_error: true
cursor:
  last_execution_datetime:
    value: "[[formatDate now]]"

{{ else if eq .input "file" }}
type: log
paths:
{{ range $i, $path := .paths }}
  - {{$path}}
{{ end }}
exclude_files: [".gz$"]
{{ end }}

tags: {{.tags | tojson}}
publisher_pipeline.disable_host: {{ inList .tags "forwarded" }}

processors:
  - add_fields:
      target: ''
      fields:
        ecs.version: 1.12.0
  - script:
      lang: javascript
      id: gworkspace-common
      file: ${path.home}/module/google_workspace/config/common.js
  - script:
      lang: javascript
      id: gworkspace-admin
      file: ${path.home}/module/google_workspace/user_accounts/config/pipeline.js
