packages/atlassian_jira/data_stream/audit/agent/stream/httpjson.yml.hbs

config_version: "2"
interval: {{interval}}
request.method: "GET"
{{#if enable_request_tracer}}
request.tracer.filename: "../../logs/httpjson/http-request-trace-*.ndjson"
request.tracer.maxbackups: 5
{{/if}}
{{#if atlassian_cloud}}
request.url: {{api_url}}/rest/api/3/auditing/record
{{else}}
request.url: {{api_url}}/rest/auditing/1.0/events
{{/if}}
{{#if ssl}}
request.ssl: {{ssl}}
{{/if}}
{{#if http_client_timeout}}
request.timeout: {{http_client_timeout}}
{{/if}}
{{#if proxy_url }}
request.proxy_url: {{proxy_url}}
{{/if}}
{{#unless token}}
{{#if username}}
{{#if password}}
auth.basic.user: {{username}}
auth.basic.password: {{password}}
{{/if}}
{{/if}}
{{/unless}}

request.transforms:
  - set:
      target: url.params.limit
      value: {{ limit }}
{{#if atlassian_cloud}}
  - set:
      target: url.params.from
      value: "[[.cursor.last_timestamp]]"
      default: '[[formatDate (now (parseDuration "-{{initial_interval}}")) "2006-01-02T15:04:05.999"]]'
  - set:
      target: url.params.to
      value: '[[formatDate (now) "2006-01-02T15:04:05.999"]]'
  - set:
      target: url.params.offset
      value: '0'
response.split:
  target: body.records
  ignore_empty_value: true
response.pagination:
  - set:
      target: url.params.from
      value: '[[.last_response.url.params.Get "from"]]'
  - set:
      target: url.params.to
      value: '[[.last_response.url.params.Get "to"]]'
  - set:
      target: url.params.offset
      value: '[[if lt (add (toInt .last_response.body.offset) (toInt "{{ limit }}")) (toInt .last_response.body.total)]][[add (toInt .last_response.body.offset) (toInt "{{ limit }}")]][[else]][[/*Stop condition for pagination*/]][[end]]'
      fail_on_template_error: true
  - set:
      target: url.params.limit
      value: '{{limit}}'
cursor:
  last_timestamp:
    value: '[[formatDate (parseTimestampMilli (add (parseDate .first_event.created "2006-01-02T15:04:05.999+0000").UnixMilli 1)) "2006-01-02T15:04:05.999Z"]]'
{{else}}
{{#unless username}}
{{#unless password}}
{{#if token}}
  - set:
      target: header.Authorization
      value: Bearer {{token}}
{{/if}}
{{/unless}}
{{/unless}}
  - set:
      target: url.params.from
      value: "[[.cursor.last_timestamp]]"
      default: '[[formatDate (now (parseDuration "-{{initial_interval}}"))]]'
  - set:
      target: url.params.to
      value: '[[formatDate now]]'
response.split:
  target: body.entities
  ignore_empty_value: true
response.pagination:
  - set:
      target: url.value
      value: '[[ .last_response.body.pagingInfo.nextPageLink ]]'
      fail_on_template_error: true

cursor:
  last_timestamp:
    value: '[[formatDate (parseTimestampMilli (add (parseDate .first_event.timestamp).UnixMilli 1)) "2006-01-02T15:04:05.999Z"]]'
{{/if}}

tags:
{{#if preserve_original_event}}
  - preserve_original_event
{{/if}}
{{#each tags as |tag i|}}
  - {{tag}}
{{/each}}

{{#contains "forwarded" tags}}
publisher_pipeline.disable_host: true
{{/contains}}

{{#if atlassian_cloud}}
fields_under_root: true
fields:
  _config:
    atlassian_cloud: true
{{/if}}

{{#if processors}}
processors:
{{processors}}
{{/if}}