packages/okta/data_stream/system/agent/stream/httpjson.yml.hbs

config_version: "2"
interval: {{interval}}

request.tracer:
  enabled: {{enable_request_tracer}}
  filename: "../../logs/httpjson/http-request-trace-*.ndjson"
  maxbackups: 5

request.method: "GET"
request.keep_alive.disable: {{disable_keep_alive}}
request.url: {{url}}
request.rate_limit:
  limit: '[[.last_response.header.Get "X-Rate-Limit-Limit"]]'
  remaining: '[[.last_response.header.Get "X-Rate-Limit-Remaining"]]'
  reset: '[[.last_response.header.Get "X-Rate-Limit-Reset"]]'

{{#if ssl}}
request.ssl: {{ssl}}
{{/if}}

{{#if http_client_timeout}}
request.timeout: {{http_client_timeout}}
{{/if}}

{{#if proxy_url }}
request.proxy_url: {{proxy_url}}
{{/if}}

{{! oin flow auth.oauth2 section}}
{{#if oin_app}}
{{#if api_key}}
{{#if okta_domain_url}}
{{#if client_id}}
auth.oauth2.token_url: {{okta_domain_url}}/oauth2/v1/token
auth.oauth2.client.id: {{client_id}}
auth.oauth2.client.secret: {{api_key}}
auth.oauth2.scopes:
  - okta.logs.read
{{/if}}
{{/if}}
{{/if}}
{{/if}}

{{! conditional auth.oauth2 section}}
{{#unless api_key}}
{{#if okta_domain_url}}
{{#if client_id}}
auth.oauth2.provider: okta
auth.oauth2.token_url: {{okta_domain_url}}/oauth2/v1/token
auth.oauth2.client.id: {{client_id}}
auth.oauth2.scopes:
{{#each okta_scopes as |scope|}}
  - {{scope}}
{{/each}}
{{#if jwk_json}}
auth.oauth2.okta.jwk_json: {{jwk_json}}
{{/if}}
{{#if jwk_file}}
auth.oauth2.okta.jwk_file: {{jwk_file}}
{{/if}}
{{#if key_pem}}
auth.oauth2.okta.jwk_pem: {{escape_string key_pem}}
{{/if}}
{{/if}}
{{/if}}
{{/unless}}

request.transforms:
{{#unless oin_app}}
{{#unless client_id}}
{{#unless okta_domain_url}}
{{#if api_key }}
  - set:
      target: header.Authorization
      value: "SSWS {{api_key}}"
{{/if}}
{{/unless}}
{{/unless}}
{{/unless}}
  - set:
      target: url.params.limit
      value: '1000'
  - set:
      target: url.params.since
      value: "[[.cursor.published]]"
      default: '[[formatDate (now (parseDuration "-{{initial_interval}}")) "RFC3339"]]'

response.pagination:
  - set:
      target: url.value
      value: '[[ getRFC5988Link "next" .last_response.header.Link ]]'
      fail_on_template_error: true

cursor:
  published:
    value: "[[.last_event.published]]"

tags:
{{#if preserve_original_event}}
  - preserve_original_event
{{/if}}
{{#each tags as |tag|}}
  - {{tag}}
{{/each}}
{{#contains "forwarded" tags}}
publisher_pipeline.disable_host: true
{{/contains}}
fields_under_root: true
fields:
  _conf:
    remove_flattened_debug: {{remove_flattened_debug}}
processors:
{{#if processors}}
{{processors}}
{{/if}}
- add_fields:
    target: ''
    fields:
      okta_url: {{url}}