{{ if eq .input "httpjson" }}

type: httpjson
interval: {{ .interval }}

{{ if .username }}
auth.basic.user: {{ .username }}
{{ end }}
{{ if .password }}
auth.basic.password: {{ .password }}
{{ end }}
request.method: GET
{{ if .ssl }}
request.ssl: {{ .ssl | tojson }}
{{ end }}
{{ if .proxy_url }}
request.proxy_url: {{ .proxy_url }}
{{ end }}
request.url: {{ .url }}
request.redirect.forward_headers: true
request.transforms:
- set:
    target: header.Content-Type
    value: application/vnd.oasis.taxii+json
- set:
    target: header.Accept
    value: application/vnd.oasis.taxii+json
- set:
    target: header.Range
    value: items 0-10000
- set:
    target: url.params.match[type]
    value: indicator
- set:
    target: url.params.added_after
    value: '[[.cursor.timestamp]]'
    default: '[[ formatDate (now (parseDuration "-{{ .first_interval }}")) "2006-01-02T15:04:05.000Z" ]]'

response.split:
  target: body.objects

cursor:
  timestamp:
    value: '[[ .last_response.header.Get "X-TAXII-Date-Added-Last" ]]'

{{ else if eq .input "file" }}

type: log
paths:
{{ range $i, $path := .paths }}
  - {{$path}}
{{ end }}
exclude_files: [".gz$"]

{{ end }}

tags:
{{if .preserve_original_event}}
  - preserve_original_event
{{end}}
{{range $val := .tags}}
  - {{$val}}
{{end}}

publisher_pipeline.disable_host: {{ inList .tags "forwarded" }}

processors:
  - add_locale: ~
  - add_fields:
      target: ''
      fields:
        ecs.version: 1.12.0
