x-pack/filebeat/module/google_workspace/admin/config/pipeline.js

// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
// or more contributor license agreements. Licensed under the Elastic License;
// you may not use this file except in compliance with the Elastic License.

var login = (function () {
    var processor = require("processor");

    var categorizeEvent = function(evt) {
        // not convinced that these should be iam
        evt.Put("event.category", ["iam"]);
        switch (evt.Get("event.action")) {
            case "CHANGE_APPLICATION_SETTING":
            case "UPDATE_MANAGED_CONFIGURATION":
            case "CHANGE_CALENDAR_SETTING":
            case "CHANGE_CHAT_SETTING":
            case "CHANGE_CHROME_OS_ANDROID_APPLICATION_SETTING":
            case "GPLUS_PREMIUM_FEATURES":
            case "UPDATE_CALENDAR_RESOURCE_FEATURE":
            case "FLASHLIGHT_EDU_NON_FEATURED_SERVICES_SELECTED":
            case "MEET_INTEROP_MODIFY_GATEWAY":
            case "CHANGE_CHROME_OS_APPLICATION_SETTING":
            case "CHANGE_CHROME_OS_DEVICE_SETTING":
            case "CHANGE_CHROME_OS_PUBLIC_SESSION_SETTING":
            case "CHANGE_CHROME_OS_SETTING":
            case "CHANGE_CHROME_OS_USER_SETTING":
            case "CHANGE_CONTACTS_SETTING":
            case "CHANGE_DOCS_SETTING":
            case "CHANGE_SITES_SETTING":
            case "CHANGE_EMAIL_SETTING":
            case "CHANGE_GMAIL_SETTING":
            case "ALLOW_STRONG_AUTHENTICATION":
            case "ALLOW_SERVICE_FOR_OAUTH2_ACCESS":
            case "DISALLOW_SERVICE_FOR_OAUTH2_ACCESS":
            case "CHANGE_APP_ACCESS_SETTINGS_COLLECTION_ID":
            case "CHANGE_TWO_STEP_VERIFICATION_ENROLLMENT_PERIOD_DURATION":
            case "CHANGE_TWO_STEP_VERIFICATION_FREQUENCY":
            case "CHANGE_TWO_STEP_VERIFICATION_GRACE_PERIOD_DURATION":
            case "CHANGE_TWO_STEP_VERIFICATION_START_DATE":
            case "CHANGE_ALLOWED_TWO_STEP_VERIFICATION_METHODS":
            case "CHANGE_SITES_WEB_ADDRESS_MAPPING_UPDATES":
            case "ENABLE_NON_ADMIN_USER_PASSWORD_RECOVERY":
            case "ENFORCE_STRONG_AUTHENTICATION":
            case "UPDATE_ERROR_MSG_FOR_RESTRICTED_OAUTH2_APPS":
            case "WEAK_PROGRAMMATIC_LOGIN_SETTINGS_CHANGED":
            case "SESSION_CONTROL_SETTINGS_CHANGE":
            case "CHANGE_SESSION_LENGTH":
            case "TOGGLE_OAUTH_ACCESS_TO_ALL_APIS":
            case "TOGGLE_ALLOW_ADMIN_PASSWORD_RESET":
            case "ENABLE_API_ACCESS":
            case "CHANGE_WHITELIST_SETTING":
            case "COMMUNICATION_PREFERENCES_SETTING_CHANGE":
            case "ENABLE_FEEDBACK_SOLICITATION":
            case "TOGGLE_CONTACT_SHARING":
            case "TOGGLE_USE_CUSTOM_LOGO":
            case "CHANGE_DATA_LOCALIZATION_SETTING":
            case "TOGGLE_ENABLE_OAUTH_CONSUMER_KEY":
            case "TOGGLE_SSO_ENABLED":
            case "TOGGLE_SSL":
            case "TOGGLE_NEW_APP_FEATURES":
            case "TOGGLE_USE_NEXT_GEN_CONTROL_PANEL":
            case "TOGGLE_OPEN_ID_ENABLED":
            case "TOGGLE_OUTBOUND_RELAY":
            case "CHANGE_SSO_SETTINGS":
            case "ENABLE_SERVICE_OR_FEATURE_NOTIFICATIONS":
            case "CHANGE_MOBILE_APPLICATION_SETTINGS":
            case "CHANGE_MOBILE_SETTING":
                evt.AppendTo("event.category", "configuration")
                evt.Put("event.type", ["change"]);
                break;
            case "UPDATE_BUILDING":
            case "RENAME_CALENDAR_RESOURCE":
            case "UPDATE_CALENDAR_RESOURCE":
            case "CANCEL_CALENDAR_EVENTS":
            case "RELEASE_CALENDAR_RESOURCES":
            case "CHANGE_DEVICE_STATE":
            case "CHANGE_CHROME_OS_DEVICE_ANNOTATION":
            case "CHANGE_CHROME_OS_DEVICE_STATE":
            case "UPDATE_CHROME_OS_PRINT_SERVER":
            case "UPDATE_CHROME_OS_PRINTER":
            case "MOVE_DEVICE_TO_ORG_UNIT_DETAILED":
            case "UPDATE_DEVICE":
            case "SEND_CHROME_OS_DEVICE_COMMAND":
            case "ASSIGN_ROLE":
            case "ADD_PRIVILEGE":
            case "REMOVE_PRIVILEGE":
            case "RENAME_ROLE":
            case "UPDATE_ROLE":
            case "UNASSIGN_ROLE":
            case "TRANSFER_DOCUMENT_OWNERSHIP":
            case "ORG_USERS_LICENSE_ASSIGNMENT":
            case "ORG_ALL_USERS_LICENSE_ASSIGNMENT":
            case "USER_LICENSE_ASSIGNMENT":
            case "CHANGE_LICENSE_AUTO_ASSIGN":
            case "USER_LICENSE_REASSIGNMENT":
            case "ORG_LICENSE_REVOKE":
            case "USER_LICENSE_REVOKE":
            case "UPDATE_DYNAMIC_LICENSE":
            case "DROP_FROM_QUARANTINE":
            case "REJECT_FROM_QUARANTINE":
            case "RELEASE_FROM_QUARANTINE":
            case "CHROME_LICENSES_ENABLED":
            case "CHROME_APPLICATION_LICENSE_RESERVATION_UPDATED":
            case "ASSIGN_CUSTOM_LOGO":
            case "UNASSIGN_CUSTOM_LOGO":
            case "REVOKE_ENROLLMENT_TOKEN":
            case "CHROME_LICENSES_ALLOWED":
            case "EDIT_ORG_UNIT_DESCRIPTION":
            case "MOVE_ORG_UNIT":
            case "EDIT_ORG_UNIT_NAME":
            case "REVOKE_DEVICE_ENROLLMENT_TOKEN":
            case "TOGGLE_SERVICE_ENABLED":
            case "ADD_TO_TRUSTED_OAUTH2_APPS":
            case "REMOVE_FROM_TRUSTED_OAUTH2_APPS":
            case "BLOCK_ON_DEVICE_ACCESS":
            case "TOGGLE_CAA_ENABLEMENT":
            case "CHANGE_CAA_ERROR_MESSAGE":
            case "CHANGE_CAA_APP_ASSIGNMENTS":
            case "UNTRUST_DOMAIN_OWNED_OAUTH2_APPS":
            case "TRUST_DOMAIN_OWNED_OAUTH2_APPS":
            case "UNBLOCK_ON_DEVICE_ACCESS":
            case "CHANGE_ACCOUNT_AUTO_RENEWAL":
            case "ADD_APPLICATION":
            case "ADD_APPLICATION_TO_WHITELIST":
            case "CHANGE_ADVERTISEMENT_OPTION":
            case "CHANGE_ALERT_CRITERIA":
            case "ALERT_RECEIVERS_CHANGED":
            case "RENAME_ALERT":
            case "ALERT_STATUS_CHANGED":
            case "ADD_DOMAIN_ALIAS":
            case "REMOVE_DOMAIN_ALIAS":
            case "AUTHORIZE_API_CLIENT_ACCESS":
            case "REMOVE_API_CLIENT_ACCESS":
            case "CHROME_LICENSES_REDEEMED":
            case "TOGGLE_AUTO_ADD_NEW_SERVICE":
            case "CHANGE_PRIMARY_DOMAIN":
            case "CHANGE_CONFLICT_ACCOUNT_ACTION":
            case "CHANGE_CUSTOM_LOGO":
            case "CHANGE_DATA_LOCALIZATION_FOR_RUSSIA":
            case "CHANGE_DATA_PROTECTION_OFFICER_CONTACT_INFO":
            case "CHANGE_DOMAIN_DEFAULT_LOCALE":
            case "CHANGE_DOMAIN_DEFAULT_TIMEZONE":
            case "CHANGE_DOMAIN_NAME":
            case "TOGGLE_ENABLE_PRE_RELEASE_FEATURES":
            case "CHANGE_DOMAIN_SUPPORT_MESSAGE":
            case "ADD_TRUSTED_DOMAINS":
            case "REMOVE_TRUSTED_DOMAINS":
            case "CHANGE_EDU_TYPE":
            case "CHANGE_EU_REPRESENTATIVE_CONTACT_INFO":
            case "CHANGE_LOGIN_BACKGROUND_COLOR":
            case "CHANGE_LOGIN_BORDER_COLOR":
            case "CHANGE_LOGIN_ACTIVITY_TRACE":
            case "PLAY_FOR_WORK_ENROLL":
            case "PLAY_FOR_WORK_UNENROLL":
            case "UPDATE_DOMAIN_PRIMARY_ADMIN_EMAIL":
            case "CHANGE_ORGANIZATION_NAME":
            case "CHANGE_PASSWORD_MAX_LENGTH":
            case "CHANGE_PASSWORD_MIN_LENGTH":
            case "REMOVE_APPLICATION":
            case "REMOVE_APPLICATION_FROM_WHITELIST":
            case "CHANGE_RENEW_DOMAIN_REGISTRATION":
            case "CHANGE_RESELLER_ACCESS":
            case "RULE_ACTIONS_CHANGED":
            case "CHANGE_RULE_CRITERIA":
            case "RENAME_RULE":
            case "RULE_STATUS_CHANGED":
            case "ADD_SECONDARY_DOMAIN":
            case "REMOVE_SECONDARY_DOMAIN":
            case "UPDATE_DOMAIN_SECONDARY_EMAIL":
            case "UPDATE_RULE":
            case "ADD_MOBILE_CERTIFICATE":
            case "COMPANY_OWNED_DEVICE_BLOCKED":
            case "COMPANY_OWNED_DEVICE_UNBLOCKED":
            case "COMPANY_OWNED_DEVICE_WIPED":
            case "CHANGE_MOBILE_APPLICATION_PERMISSION_GRANT":
            case "CHANGE_MOBILE_APPLICATION_PRIORITY_ORDER":
            case "REMOVE_MOBILE_APPLICATION_FROM_WHITELIST":
            case "ADD_MOBILE_APPLICATION_TO_WHITELIST":
            case "CHANGE_ADMIN_RESTRICTIONS_PIN":
            case "CHANGE_MOBILE_WIRELESS_NETWORK":
            case "ADD_MOBILE_WIRELESS_NETWORK":
            case "REMOVE_MOBILE_WIRELESS_NETWORK":
            case "CHANGE_MOBILE_WIRELESS_NETWORK_PASSWORD":
            case "REMOVE_MOBILE_CERTIFICATE":
                evt.Put("event.type", ["change"]);
                break;
            case "CREATE_APPLICATION_SETTING":
            case "CREATE_GMAIL_SETTING":
                evt.AppendTo("event.category", "configuration")
                evt.Put("event.type", ["creation"]);
                break;
            case "CREATE_MANAGED_CONFIGURATION":
            case "CREATE_BUILDING":
            case "CREATE_CALENDAR_RESOURCE":
            case "CREATE_CALENDAR_RESOURCE_FEATURE":
            case "MEET_INTEROP_CREATE_GATEWAY":
            case "INSERT_CHROME_OS_PRINT_SERVER":
            case "INSERT_CHROME_OS_PRINTER":
            case "CREATE_ROLE":
            case "ADD_WEB_ADDRESS":
            case "EMAIL_UNDELETE":
            case "CHROME_APPLICATION_LICENSE_RESERVATION_CREATED":
            case "CREATE_DEVICE_ENROLLMENT_TOKEN":
            case "CREATE_ENROLLMENT_TOKEN":
            case "CREATE_ORG_UNIT":
            case "CREATE_ALERT":
            case "CREATE_PLAY_FOR_WORK_TOKEN":
            case "GENERATE_TRANSFER_TOKEN":
            case "REGENERATE_OAUTH_CONSUMER_SECRET":
            case "CREATE_RULE":
            case "GENERATE_PIN":
            case "COMPANY_DEVICES_BULK_CREATION":
                evt.Put("event.type", ["creation"]);
                break;
            case "DELETE_APPLICATION_SETTING":
            case "DELETE_GMAIL_SETTING":
                evt.AppendTo("event.category", "configuration")
                evt.Put("event.type", ["deletion"]);
                break;
            case "DELETE_MANAGED_CONFIGURATION":
            case "DELETE_BUILDING":
            case "DELETE_CALENDAR_RESOURCE":
            case "DELETE_CALENDAR_RESOURCE_FEATURE":
            case "MEET_INTEROP_DELETE_GATEWAY":
            case "DELETE_CHROME_OS_PRINT_SERVER":
            case "DELETE_CHROME_OS_PRINTER":
            case "REMOVE_CHROME_OS_APPLICATION_SETTINGS":
            case "DELETE_ROLE":
            case "DELETE_WEB_ADDRESS":
            case "CHROME_APPLICATION_LICENSE_RESERVATION_DELETED":
            case "REMOVE_ORG_UNIT":
            case "DELETE_ALERT":
            case "DELETE_PLAY_FOR_WORK_TOKEN":
            case "DELETE_RULE":
            case "COMPANY_DEVICE_DELETION":
                evt.Put("event.type", ["deletion"]);
                break;
            case "DELETE_GROUP":
                evt.Put("event.type", ["group", "creation"]);
                break;
            case "CREATE_GROUP":
                evt.Put("event.type", ["group", "creation"]);
                break;
            case "REORDER_GROUP_BASED_POLICIES_EVENT":
            case "CHANGE_GROUP_DESCRIPTION":
            case "ADD_GROUP_MEMBER":
            case "REMOVE_GROUP_MEMBER":
            case "UPDATE_GROUP_MEMBER":
            case "UPDATE_GROUP_MEMBER_DELIVERY_SETTINGS":
            case "UPDATE_GROUP_MEMBER_DELIVERY_SETTINGS_CAN_EMAIL_OVERRIDE":
            case "CHANGE_GROUP_NAME":
            case "CHANGE_GROUP_SETTING":
            case "GROUP_MEMBER_BULK_UPLOAD":
            case "WHITELISTED_GROUPS_UPDATED":
                evt.Put("event.type", ["group", "change"]);
                break;
            case "REVOKE_3LO_DEVICE_TOKENS":
            case "REVOKE_3LO_TOKEN":
            case "ADD_RECOVERY_EMAIL":
            case "ADD_RECOVERY_PHONE":
            case "GRANT_ADMIN_PRIVILEGE":
            case "REVOKE_ADMIN_PRIVILEGE":
            case "REVOKE_ASP":
            case "TOGGLE_AUTOMATIC_CONTACT_SHARING":
            case "CANCEL_USER_INVITE":
            case "CHANGE_USER_CUSTOM_FIELD":
            case "CHANGE_USER_EXTERNAL_ID":
            case "CHANGE_USER_GENDER":
            case "CHANGE_USER_IM":
            case "ENABLE_USER_IP_WHITELIST":
            case "CHANGE_USER_KEYWORD":
            case "CHANGE_USER_LANGUAGE":
            case "CHANGE_USER_LOCATION":
            case "CHANGE_USER_ORGANIZATION":
            case "CHANGE_USER_PHONE_NUMBER":
            case "CHANGE_RECOVERY_EMAIL":
            case "CHANGE_RECOVERY_PHONE":
            case "CHANGE_USER_RELATION":
            case "CHANGE_USER_ADDRESS":
            case "GRANT_DELEGATED_ADMIN_PRIVILEGES":
            case "CHANGE_FIRST_NAME":
            case "GMAIL_RESET_USER":
            case "CHANGE_LAST_NAME":
            case "MAIL_ROUTING_DESTINATION_ADDED":
            case "MAIL_ROUTING_DESTINATION_REMOVED":
            case "ADD_NICKNAME":
            case "REMOVE_NICKNAME":
            case "CHANGE_PASSWORD":
            case "CHANGE_PASSWORD_ON_NEXT_LOGIN":
            case "REMOVE_RECOVERY_EMAIL":
            case "REMOVE_RECOVERY_PHONE":
            case "RESET_SIGNIN_COOKIES":
            case "SECURITY_KEY_REGISTERED_FOR_USER":
            case "REVOKE_SECURITY_KEY":
            case "TURN_OFF_2_STEP_VERIFICATION":
            case "UNBLOCK_USER_SESSION":
            case "UNENROLL_USER_FROM_TITANIUM":
            case "ARCHIVE_USER":
            case "UPDATE_BIRTHDATE":
            case "DOWNGRADE_USER_FROM_GPLUS":
            case "USER_ENROLLED_IN_TWO_STEP_VERIFICATION":
            case "MOVE_USER_TO_ORG_UNIT":
            case "USER_PUT_IN_TWO_STEP_VERIFICATION_GRACE_PERIOD":
            case "RENAME_USER":
            case "UNENROLL_USER_FROM_STRONG_AUTH":
            case "SUSPEND_USER":
            case "UNARCHIVE_USER":
            case "UNSUSPEND_USER":
            case "UPGRADE_USER_TO_GPLUS":
            case "MOBILE_DEVICE_APPROVE":
            case "MOBILE_DEVICE_BLOCK":
            case "MOBILE_DEVICE_WIPE":
            case "MOBILE_ACCOUNT_WIPE":
            case "MOBILE_DEVICE_CANCEL_WIPE_THEN_APPROVE":
            case "MOBILE_DEVICE_CANCEL_WIPE_THEN_BLOCK":
                evt.Put("event.type", ["user", "change"]);
                break;
            case "DELETE_2SV_SCRATCH_CODES":
            case "DELETE_ACCOUNT_INFO_DUMP":
            case "DELETE_EMAIL_MONITOR":
            case "DELETE_MAILBOX_DUMP":
            case "DELETE_USER":
            case "MOBILE_DEVICE_DELETE":
                evt.Put("event.type", ["user", "deletion"]);
                break;
            case "GENERATE_2SV_SCRATCH_CODES":
            case "CREATE_EMAIL_MONITOR":
            case "CREATE_DATA_TRANSFER_REQUEST":
            case "CREATE_USER":
            case "UNDELETE_USER":
                evt.Put("event.type", ["user", "creation"]);
                break;
            case "ISSUE_DEVICE_COMMAND":
            case "DRIVE_DATA_RESTORE":
            case "VIEW_SITE_DETAILS":
            case "EMAIL_LOG_SEARCH":
            case "SKIP_DOMAIN_ALIAS_MX":
            case "VERIFY_DOMAIN_ALIAS_MX":
            case "VERIFY_DOMAIN_ALIAS":
            case "VIEW_DNS_LOGIN_DETAILS":
            case "MX_RECORD_VERIFICATION_CLAIM":
            case "UPLOAD_OAUTH_CERTIFICATE":
            case "SKIP_SECONDARY_DOMAIN_MX":
            case "VERIFY_SECONDARY_DOMAIN_MX":
            case "VERIFY_SECONDARY_DOMAIN":
            case "BULK_UPLOAD":
            case "DOWNLOAD_PENDING_INVITES_LIST":
            case "DOWNLOAD_USERLIST_CSV":
            case "USERS_BULK_UPLOAD":
            case "ENROLL_FOR_GOOGLE_DEVICE_MANAGEMENT":
            case "USE_GOOGLE_MOBILE_MANAGEMENT":
            case "USE_GOOGLE_MOBILE_MANAGEMENT_FOR_NON_IOS":
            case "USE_GOOGLE_MOBILE_MANAGEMENT_FOR_IOS":
                evt.Put("event.type", ["info"]);
                break;
            case "GROUP_LIST_DOWNLOAD":
            case "GROUP_MEMBERS_DOWNLOAD":
                evt.Put("event.type", ["group", "info"]);
                break;
            case "REQUEST_ACCOUNT_INFO":
            case "REQUEST_MAILBOX_DUMP":
            case "RESEND_USER_INVITE":
            case "BULK_UPLOAD_NOTIFICATION_SENT":
            case "USER_INVITE":
            case "VIEW_TEMP_PASSWORD":
            case "USERS_BULK_UPLOAD_NOTIFICATION_SENT":
            case "ACTION_CANCELLED":
            case "ACTION_REQUESTED":
                evt.Put("event.type", ["user", "info"]);
                break;
        }
    };

    var getParamValue = function(param) {
        if (param.value) {
            return param.value;
        }
        if (param.multiValue) {
            return param.multiValue;
        }
        if (param.intValue !== null) {
            return param.intValue;
        }
    };

    var flattenParams = function(evt) {
        var params = evt.Get("json.events.parameters");
        if (!params || !Array.isArray(params)) {
            return;
        }

        params.forEach(function(p){
            evt.Put("google_workspace.admin."+p.name, getParamValue(p));
        });

        evt.Delete("json.events.parameters");
    };

    var setGroupInfo = function(evt) {
        var email = evt.Get("google_workspace.admin.group.email");
        if (!email) {
            return;
        }

        var data = email.split("@");
        if (data.length !== 2) {
            return;
        }

        evt.Put("group.name", data[0]);
        evt.Put("group.domain", data[1]);
    };

    var setRelatedUserInfo = function(evt) {
        var email = evt.Get("google_workspace.admin.user.email");
        if (!email) {
            return;
        }

        var data = email.split("@");
        if (data.length !== 2) {
            return;
        }

        evt.AppendTo("related.user", data[0]);
        evt.Put("user.target.name", data[0]);
        evt.Put("user.target.domain", data[1]);
        evt.Put("user.target.email", email);
        var groupName = evt.Get("group.name");
        if (groupName) {
            evt.Put("user.target.group.name", groupName);
        }
        var groupDomain = evt.Get("group.domain");
        if (groupDomain) {
            evt.Put("user.target.group.domain", groupDomain);
        }
    };

    var setEventDuration = function(evt) {
        var start = evt.Get("event.start");
        var end = evt.Get("event.end");
        if (!start || !end) {
            return;
        }

        evt.Put("event.duration", end.UnixNano() - start.UnixNano());
    };

    var setEventOutcome = function(evt) {
        var failed = evt.Get("google_workspace.admin.group.bulk_upload.failed");
        if (failed === null) {
            return;
        }

        if (failed === 0) {
            evt.Put("event.outcome", "success");
        } else {
            evt.Put("event.outcome", "failure");
        }
    };

    var setGroupAllowedlist = function(evt) {
        var allowedList = evt.Get("google_workspace.admin.WHITELISTED_GROUPS");
        if (!allowedList) {
            return;
        }

        evt.Put("google_workspace.admin.group.allowed_list", allowedList.split(","));
        evt.Delete("google_workspace.admin.WHITELISTED_GROUPS");
    };

    var deleteField = function(field) {
        return function(evt) {
            evt.Delete(field);
        };
    };

    var parseDate = function(field, targetField) {
        return new processor.Chain()
            .Add(new processor.Timestamp({
                field: field,
                target_field: targetField,
                timezone: "UTC",
                layouts: [
                    "2006-01-02T15:04:05Z",
                    "2006-01-02T15:04:05.999Z",
                    "2006/01/02 15:04:05 UTC",
                ],
                tests: [
                    "2020-02-05T18:19:23Z",
                    "2020-02-05T18:19:23.599Z",
                    "2020/07/28 04:59:59 UTC",
                ],
                ignore_missing: true,
            }))
            .Add(deleteField(field))
            .Build()
    };

    var pipeline = new processor.Chain()
        .Add(categorizeEvent)
        .Add(flattenParams)
        .Convert({
            fields: [
                {
                    from: "google_workspace.admin.APPLICATION_EDITION",
                    to: "google_workspace.admin.application.edition",
                },
                {
                    from: "google_workspace.admin.APPLICATION_NAME",
                    to: "google_workspace.admin.application.name",
                },
                {
                    from: "google_workspace.admin.APPLICATION_ENABLED",
                    to: "google_workspace.admin.application.enabled",
                },
                {
                    from: "google_workspace.admin.APP_LICENSES_ORDER_NUMBER",
                    to: "google_workspace.admin.application.licences_order_number",
                },
                {
                    from: "google_workspace.admin.CHROME_NUM_LICENSES_PURCHASED",
                    to: "google_workspace.admin.application.licences_purchased",
                    type: "long",
                },
                {
                    from: "google_workspace.admin.REAUTH_APPLICATION",
                    to: "google_workspace.admin.application.name",
                },
                {
                    from: "google_workspace.admin.GROUP_EMAIL",
                    to: "google_workspace.admin.group.email",
                },
                {
                    from: "google_workspace.admin.GROUP_NAME",
                    to: "group.name",
                },
                {
                    from: "google_workspace.admin.NEW_VALUE",
                    to: "google_workspace.admin.new_value",
                },
                {
                    from: "google_workspace.admin.OLD_VALUE",
                    to: "google_workspace.admin.old_value",
                },
                {
                    from: "google_workspace.admin.ORG_UNIT_NAME",
                    to: "google_workspace.admin.org_unit.name",
                },
                {
                    from: "google_workspace.admin.SETTING_NAME",
                    to: "google_workspace.admin.setting.name",
                },
                {
                    from: "google_workspace.admin.SETTING_DESCRIPTION",
                    to: "google_workspace.admin.setting.description",
                },
                {
                    from: "google_workspace.admin.USER_DEFINED_SETTING_NAME",
                    to: "google_workspace.admin.user_defined_setting.name",
                },
                {
                    from: "google_workspace.admin.GROUP_PRIORITIES",
                    to: "google_workspace.admin.group.priorities",
                },
                {
                    from: "google_workspace.admin.DOMAIN_NAME",
                    to: "google_workspace.admin.domain.name",
                },
                {
                    from: "google_workspace.admin.DOMAIN_ALIAS",
                    to: "google_workspace.admin.domain.alias",
                },
                {
                    from: "google_workspace.admin.SECONDARY_DOMAIN_NAME",
                    to: "google_workspace.admin.domain.secondary_name",
                },
                {
                    from: "google_workspace.admin.MANAGED_CONFIGURATION_NAME",
                    to: "google_workspace.admin.managed_configuration",
                },
                {
                    from: "google_workspace.admin.MOBILE_APP_PACKAGE_ID",
                    to: "google_workspace.admin.application.package_id",
                },
                {
                    from: "google_workspace.admin.FLASHLIGHT_EDU_NON_FEATURED_SERVICES_SELECTION",
                    to: "google_workspace.admin.non_featured_services_selection",
                },
                {
                    from: "google_workspace.admin.FIELD_NAME",
                    to: "google_workspace.admin.field",
                },
                {
                    from: "google_workspace.admin.RESOURCE_IDENTIFIER",
                    to: "google_workspace.admin.resource.id",
                },
                {
                    from: "google_workspace.admin.USER_EMAIL",
                    to: "google_workspace.admin.user.email",
                },
                {
                    from: "google_workspace.admin.GATEWAY_NAME",
                    to: "google_workspace.admin.gateway.name",
                },
                {
                    from: "google_workspace.admin.APP_ID",
                    to: "google_workspace.admin.application.id",
                },
                {
                    from: "google_workspace.admin.ASP_ID",
                    to: "google_workspace.admin.application.asp_id",
                },
                {
                    from: "google_workspace.admin.CHROME_OS_SESSION_TYPE",
                    to: "google_workspace.admin.chrome_os.session_type",
                },
                {
                    from: "google_workspace.admin.DEVICE_NEW_STATE",
                    to: "google_workspace.admin.new_value",
                },
                {
                    from: "google_workspace.admin.DEVICE_PREVIOUS_STATE",
                    to: "google_workspace.admin.old_value",
                },
                {
                    from: "google_workspace.admin.DEVICE_SERIAL_NUMBER",
                    to: "google_workspace.admin.device.serial_number",
                },
                {
                    from: "google_workspace.admin.DEVICE_ID",
                    to: "google_workspace.admin.device.id",
                },
                {
                    from: "google_workspace.admin.DEVICE_TYPE",
                    to: "google_workspace.admin.device.type",
                },
                {
                    from: "google_workspace.admin.PRINT_SERVER_NAME",
                    to: "google_workspace.admin.print_server.name",
                },
                {
                    from: "google_workspace.admin.PRINTER_NAME",
                    to: "google_workspace.admin.printer.name",
                },
                {
                    from: "google_workspace.admin.DEVICE_COMMAND_DETAILS",
                    to: "google_workspace.admin.device.command_details",
                },
                {
                    from: "google_workspace.admin.DEVICE_NEW_ORG_UNIT",
                    to: "google_workspace.admin.new_value",
                },
                {
                    from: "google_workspace.admin.DEVICE_PREVIOUS_ORG_UNIT",
                    to: "google_workspace.admin.old_value",
                },
                {
                    from: "google_workspace.admin.ROLE_NAME",
                    to: "google_workspace.admin.role.name",
                },
                {
                    from: "google_workspace.admin.ROLE_ID",
                    to: "google_workspace.admin.role.id",
                },
                {
                    from: "google_workspace.admin.PRIVILEGE_NAME",
                    to: "google_workspace.admin.privilege.name",
                },
                {
                    from: "google_workspace.admin.SITE_LOCATION",
                    to: "url.path",
                },
                {
                    from: "google_workspace.admin.WEB_ADDRESS",
                    to: "url.full",
                },
                {
                    from: "google_workspace.admin.SITE_NAME",
                    to: "google_workspace.admin.url.name",
                },
                {
                    from: "google_workspace.admin.SERVICE_NAME",
                    to: "google_workspace.admin.service.name",
                },
                {
                    from: "google_workspace.admin.PRODUCT_NAME",
                    to: "google_workspace.admin.product.name",
                },
                {
                    from: "google_workspace.admin.SKU_NAME",
                    to: "google_workspace.admin.product.sku",
                },
                {
                    from: "google_workspace.admin.GROUP_MEMBER_BULK_UPLOAD_FAILED_NUMBER",
                    to: "google_workspace.admin.bulk_upload.failed",
                    type: "long",
                },
                {
                    from: "google_workspace.admin.GROUP_MEMBER_BULK_UPLOAD_TOTAL_NUMBER",
                    to: "google_workspace.admin.bulk_upload.total",
                    type: "long",
                },
                {
                    from: "google_workspace.admin.BULK_UPLOAD_FAIL_USERS_NUMBER",
                    to: "google_workspace.admin.bulk_upload.failed",
                    type: "long",
                },
                {
                    from: "google_workspace.admin.BULK_UPLOAD_TOTAL_USERS_NUMBER",
                    to: "google_workspace.admin.bulk_upload.total",
                    type: "long",
                },
                {
                    from: "google_workspace.admin.EMAIL_LOG_SEARCH_MSG_ID",
                    to: "google_workspace.admin.email.log_search_filter.message_id",
                },
                {
                    from: "google_workspace.admin.EMAIL_LOG_SEARCH_RECIPIENT",
                    to: "google_workspace.admin.email.log_search_filter.recipient.value",
                },
                {
                    from: "google_workspace.admin.EMAIL_LOG_SEARCH_SENDER",
                    to: "google_workspace.admin.email.log_search_filter.sender.value",
                },
                {
                    from: "google_workspace.admin.EMAIL_LOG_SEARCH_SMTP_RECIPIENT_IP",
                    to: "google_workspace.admin.email.log_search_filter.recipient.ip",
                    type: "ip",
                },
                {
                    from: "google_workspace.admin.EMAIL_LOG_SEARCH_SMTP_SENDER_IP",
                    to: "google_workspace.admin.email.log_search_filter.sender.ip",
                    type: "ip",
                },
                {
                    from: "google_workspace.admin.QUARANTINE_NAME",
                    to: "google_workspace.admin.email.quarantine_name",
                },
                {
                    from: "google_workspace.admin.CHROME_LICENSES_ENABLED",
                    to: "google_workspace.admin.chrome_licenses.enabled",
                },
                {
                    from: "google_workspace.admin.CHROME_LICENSES_ALLOWED",
                    to: "google_workspace.admin.chrome_licenses.allowed",
                },
                {
                    from: "google_workspace.admin.FULL_ORG_UNIT_PATH",
                    to: "google_workspace.admin.org_unit.full",
                },
                {
                    from: "google_workspace.admin.OAUTH2_SERVICE_NAME",
                    to: "google_workspace.admin.oauth2.service.name",
                },
                {
                    from: "google_workspace.admin.OAUTH2_APP_ID",
                    to: "google_workspace.admin.oauth2.application.id",
                },
                {
                    from: "google_workspace.admin.OAUTH2_APP_NAME",
                    to: "google_workspace.admin.oauth2.application.name",
                },
                {
                    from: "google_workspace.admin.OAUTH2_APP_TYPE",
                    to: "google_workspace.admin.oauth2.application.type",
                },
                {
                    from: "google_workspace.admin.ALLOWED_TWO_STEP_VERIFICATION_METHOD",
                    to: "google_workspace.admin.verification_method",
                },
                {
                    from: "google_workspace.admin.DOMAIN_VERIFICATION_METHOD",
                    to: "google_workspace.admin.verification_method",
                },
                {
                    from: "google_workspace.admin.CAA_ASSIGNMENTS_NEW",
                    to: "google_workspace.admin.new_value",
                },
                {
                    from: "google_workspace.admin.CAA_ASSIGNMENTS_OLD",
                    to: "google_workspace.admin.old_value",
                },
                {
                    from: "google_workspace.admin.REAUTH_SETTING_NEW",
                    to: "google_workspace.admin.new_value",
                },
                {
                    from: "google_workspace.admin.REAUTH_SETTING_OLD",
                    to: "google_workspace.admin.old_value",
                },
                {
                    from: "google_workspace.admin.ALERT_NAME",
                    to: "google_workspace.admin.alert.name",
                },
                {
                    from: "google_workspace.admin.API_CLIENT_NAME",
                    to: "google_workspace.admin.api.client.name",
                },
                {
                    from: "google_workspace.admin.API_SCOPES",
                    to: "google_workspace.admin.api.scopes",
                },
                {
                    from: "google_workspace.admin.PLAY_FOR_WORK_TOKEN_ID",
                    to: "google_workspace.admin.mdm.token",
                },
                {
                    from: "google_workspace.admin.PLAY_FOR_WORK_MDM_VENDOR_NAME",
                    to: "google_workspace.admin.mdm.vendor",
                },
                {
                    from: "google_workspace.admin.INFO_TYPE",
                    to: "google_workspace.admin.info_type",
                },
                {
                    from: "google_workspace.admin.RULE_NAME",
                    to: "google_workspace.admin.rule.name",
                },
                {
                    from: "google_workspace.admin.USER_CUSTOM_FIELD",
                    to: "google_workspace.admin.setting.name",
                },
                {
                    from: "google_workspace.admin.EMAIL_MONITOR_DEST_EMAIL",
                    to: "google_workspace.admin.email_monitor.dest_email",
                },
                {
                    from: "google_workspace.admin.EMAIL_MONITOR_LEVEL_CHAT",
                    to: "google_workspace.admin.email_monitor.level.chat",
                },
                {
                    from: "google_workspace.admin.EMAIL_MONITOR_LEVEL_DRAFT_EMAIL",
                    to: "google_workspace.admin.email_monitor.level.draft",
                },
                {
                    from: "google_workspace.admin.EMAIL_MONITOR_LEVEL_INCOMING_EMAIL",
                    to: "google_workspace.admin.email_monitor.level.incoming",
                },
                {
                    from: "google_workspace.admin.EMAIL_MONITOR_LEVEL_OUTGOING_EMAIL",
                    to: "google_workspace.admin.email_monitor.level.outgoing",
                },
                {
                    from: "google_workspace.admin.EMAIL_EXPORT_INCLUDE_DELETED",
                    to: "google_workspace.admin.email_dump.include_deleted",
                },
                {
                    from: "google_workspace.admin.EMAIL_EXPORT_PACKAGE_CONTENT",
                    to: "google_workspace.admin.email_dump.package_content",
                },
                {
                    from: "google_workspace.admin.SEARCH_QUERY_FOR_DUMP",
                    to: "google_workspace.admin.email_dump.query",
                },
                {
                    from: "google_workspace.admin.DESTINATION_USER_EMAIL",
                    to: "google_workspace.admin.new_value",
                },
                {
                    from: "google_workspace.admin.REQUEST_ID",
                    to: "google_workspace.admin.request.id",
                },
                {
                    from: "google_workspace.admin.GMAIL_RESET_REASON",
                    to: "message",
                },
                {
                    from: "google_workspace.admin.USER_NICKNAME",
                    to: "google_workspace.admin.user.nickname",
                },
                {
                    from: "google_workspace.admin.ACTION_ID",
                    to: "google_workspace.admin.mobile.action.id",
                },
                {
                    from: "google_workspace.admin.ACTION_TYPE",
                    to: "google_workspace.admin.mobile.action.type",
                },
                {
                    from: "google_workspace.admin.MOBILE_CERTIFICATE_COMMON_NAME",
                    to: "google_workspace.admin.mobile.certificate.name",
                },
                {
                    from: "google_workspace.admin.NUMBER_OF_COMPANY_OWNED_DEVICES",
                    to: "google_workspace.admin.mobile.company_owned_devices",
                    type: "long",
                },
                {
                    from: "google_workspace.admin.COMPANY_DEVICE_ID",
                    to: "google_workspace.admin.device.id",
                },
                {
                    from: "google_workspace.admin.DISTRIBUTION_ENTITY_NAME",
                    to: "google_workspace.admin.distribution.entity.name",
                },
                {
                    from: "google_workspace.admin.DISTRIBUTION_ENTITY_TYPE",
                    to: "google_workspace.admin.distribution.entity.type",
                },
                {
                    from: "google_workspace.admin.MOBILE_APP_PACKAGE_ID",
                    to: "google_workspace.admin.application.package_id",
                },
                {
                    from: "google_workspace.admin.NEW_PERMISSION_GRANT_STATE",
                    to: "google_workspace.admin.new_value",
                },
                {
                    from: "google_workspace.admin.OLD_PERMISSION_GRANT_STATE",
                    to: "google_workspace.admin.old_value",
                },
                {
                    from: "google_workspace.admin.PERMISSION_GROUP_NAME",
                    to: "google_workspace.admin.setting.name",
                },
                {
                    from: "google_workspace.admin.MOBILE_WIRELESS_NETWORK_NAME",
                    to: "network.name",
                },
            ],
            mode: "rename",
            ignore_missing: true,
            fail_on_error: false,
        })
        .Add(parseDate(
            "google_workspace.admin.EMAIL_LOG_SEARCH_END_DATE",
            "google_workspace.admin.email.log_search_filter.end_date"
        ))
        .Add(parseDate(
            "google_workspace.admin.EMAIL_LOG_SEARCH_START_DATE",
            "google_workspace.admin.email.log_search_filter.start_date"
        ))
        .Add(parseDate(
            "google_workspace.admin.BIRTHDATE",
            "google_workspace.admin.user.birthdate"
        ))
        .Add(parseDate(
            "google_workspace.admin.BEGIN_DATE_TIME",
            "event.start"
        ))
        .Add(parseDate(
            "google_workspace.admin.START_DATE",
            "event.start"
        ))
        .Add(parseDate(
            "google_workspace.admin.END_DATE",
            "event.end"
        ))
        .Add(parseDate(
            "google_workspace.admin.END_DATE_TIME",
            "event.end"
        ))
        .Add(setGroupInfo)
        .Add(setRelatedUserInfo)
        .Add(setEventDuration)
        .Add(setEventOutcome)
        .Add(setGroupAllowedlist)
        .Build();

    return {
        process: pipeline.Run,
    };
}());

function process(evt) {
    return login.process(evt);
}