packages/system/data_stream/auth/agent/stream/log.yml.hbs

{{#if condition }}
condition: {{condition}}
{{/if}}

{{#if ignore_older}}
ignore_older: {{ignore_older}}
{{/if}}
paths:
{{#each paths as |path|}}
  - {{path}}
{{/each}}
exclude_files:
  - '\.gz$'

multiline:
  pattern: "^\\s"
  match: after

tags:
{{#if preserve_original_event}}
  - preserve_original_event
{{/if}}
{{#each tags as |tag|}}
  - {{tag}}
{{/each}}

{{#contains "forwarded" tags}}
publisher_pipeline.disable_host: true
{{/contains}}
allow_deprecated_use: true

processors:
- add_locale: ~
- rename:
    fields:
      - from: message
        to: event.original
    ignore_missing: true
    fail_on_error: false
- syslog:
    field: event.original
    ignore_missing: true
    ignore_failure: true
{{#if processors}}
{{processors}}
{{/if}}