packages/atlassian_confluence/data_stream/audit/agent/stream/httpjson.yml.hbs

config_version: "2"
interval: {{interval}}
request.method: "GET"
{{#if enable_request_tracer}}
request.tracer.filename: "../../logs/httpjson/http-request-trace-*.ndjson"
request.tracer.maxbackups: 5
{{/if}}

{{#if ssl}}
request.ssl: {{ssl}}
{{/if}}

{{#if http_client_timeout}}
request.timeout: {{http_client_timeout}}
{{/if}}

{{#if proxy_url }}
request.proxy_url: {{proxy_url}}
{{/if}}

{{#unless token}}
{{#if username}}
{{#if password}}
auth.basic.user: {{username}}
auth.basic.password: {{password}}
{{/if}}
{{/if}}
{{/unless}}

{{#if atlassian_cloud}}
{{! Atlassian Confluence Cloud }}
request.url: {{api_url}}/wiki/rest/api/audit
request.transforms:
  - set:
      target: url.params.limit
      value: '{{ limit }}'
  - set:
      target: url.params.startDate
      value: '[[.cursor.last_timestamp]]'
      default: '[[(now (parseDuration "-{{initial_interval}}")).UnixMilli]]'
  - set:
      target: url.params.endDate
      value: '[[now.UnixMilli]]'
  - set:
      target: url.params.start
      value: '0'

response.split:
  target: body.results
  ignore_empty_value: true

response.pagination:
  - set:
      target: url.params.endDate
      value: '[[.last_response.url.params.Get "endDate"]]'
  - set:
      target: url.params.startDate
      value: '[[.last_response.url.params.Get "startDate"]]'
  - set:
      target: url.params.start
      value: '[[if (ne (len .last_response.body.results) 0)]][[add (toInt .last_response.body.start) (toInt .last_response.body.limit)]][[end]]'
      fail_on_template_error: true
  - set:
      target: url.params.limit
      value: '{{limit}}'
cursor:
  last_timestamp:
    value: '[[add (toInt .first_event.creationDate) 1]]'

fields_under_root: true
fields:
  _config:
    atlassian_cloud: true

{{else}}
{{! Self-hosted Confluence Data Center }}
request.url: {{api_url}}/rest/auditing/1.0/events
request.transforms:
  - set:
      target: url.params.limit
      value: '{{ limit }}'

{{#unless username}}
{{#unless password}}
{{#if token}}
  - set:
      target: header.Authorization
      value: Bearer {{token}}
{{/if}}
{{/unless}}
{{/unless}}

  - set:
      target: url.params.from
      value: '[[.cursor.last_timestamp]]'
      default: '[[formatDate (now (parseDuration "-{{initial_interval}}"))]]'
  - set:
      target: url.params.to
      value: '[[formatDate now]]'

response.split:
  target: body.entities
  ignore_empty_value: true

response.pagination:
  - set:
      target: url.value
      value: '[[ .last_response.body.pagingInfo.nextPageLink ]]'
      fail_on_template_error: true

cursor:
  last_timestamp:
    value: '[[formatDate (parseTimestampMilli (add (parseDate .first_event.timestamp).UnixMilli 1)) "2006-01-02T15:04:05.999Z"]]'
{{/if}}

tags:
{{#if preserve_original_event}}
  - preserve_original_event
{{/if}}
{{#each tags as |tag i|}}
  - {{tag}}
{{/each}}

{{#contains "forwarded" tags}}
publisher_pipeline.disable_host: true
{{/contains}}

{{#if processors}}
processors:
{{processors}}
{{/if}}