config

type AdaptiveSamplingRule struct {
	// Regex is matched against the raw log content.
	Regex string `mapstructure:"regex,omitempty" json:"regex,omitempty" yaml:"regex,omitempty"`

	// Sample is tokenized and structurally matched against the log content.
	Sample string `mapstructure:"sample,omitempty" json:"sample,omitempty" yaml:"sample,omitempty"`
}

type AutoMultilineSample struct {
	// Sample is a raw log message sample used to aggregate logs.
	Sample string `mapstructure:"sample" json:"sample" yaml:"sample"`
	// MatchThreshold is the ratio of tokens that must match between the sample and the log message to consider it a match.
	// From a user perspective, this is how similar the log has to be to the sample to be considered a match.
	// Optional - Default value is 0.75.
	MatchThreshold *float64 `mapstructure:"match_threshold,omitempty" json:"match_threshold,omitempty"`
	// Regex is a pattern used to aggregate logs. NOTE that you can use either a sample or a regex, but not both.
	Regex string `mapstructure:"regex,omitempty" json:"regex,omitempty"`
	// Label is the label to apply to the log message if it matches the sample.
	// Optional - Default value is "start_group".
	Label *string `mapstructure:"label,omitempty" json:"label,omitempty"`
}

type ChannelMessage struct {
	Content []byte
	// Optional. Must be UTC. If not provided, time.Now().UTC() will be used
	// Used in the Serverless Agent
	Timestamp time.Time
	IsError   bool
}

type DiagnosticProtocol int

type EPIntakeVersion uint8

type Endpoint struct {
	Host                    string `mapstructure:"host" json:"host"`
	Port                    int
	PathPrefix              string `mapstructure:"path_prefix" json:"path_prefix"`
	UseCompression          bool   `mapstructure:"use_compression" json:"use_compression"`
	CompressionKind         string `mapstructure:"compression_kind" json:"compression_kind"`
	CompressionLevel        int    `mapstructure:"compression_level" json:"compression_level"`
	ProxyAddress            string
	IsMRF                   bool `mapstructure:"-" json:"-"`
	ConnectionResetInterval time.Duration

	BackoffFactor    float64
	BackoffBase      float64
	BackoffMax       float64
	RecoveryInterval int
	RecoveryReset    bool

	Version   EPIntakeVersion
	TrackType IntakeTrackType
	Protocol  IntakeProtocol
	Origin    IntakeOrigin

	ExtraHTTPHeaders map[string]string
	// contains filtered or unexported fields
}

type EndpointCompressionOptions struct {
	CompressionKind  string
	CompressionLevel int
}

type Endpoints struct {
	Main                   Endpoint
	Endpoints              []Endpoint
	UseProto               bool
	UseHTTP                bool
	BatchWait              time.Duration
	BatchMaxConcurrentSend int
	BatchMaxSize           int
	BatchMaxContentSize    int
	InputChanSize          int
}

type HTTPConnectivity bool

type IntakeOrigin string

type IntakeProtocol string

type IntakeTrackType string

type LogsConfig struct {
	Type string

	IntegrationName string

	Port           int    `mapstructure:"port" json:"port" yaml:"port"`                                  // Network (tcp, udp)
	BindHost       string `mapstructure:"bind_host" json:"bind_host" yaml:"bind_host"`                   // Network (tcp, udp)
	IdleTimeout    string `mapstructure:"idle_timeout" json:"idle_timeout" yaml:"idle_timeout"`          // Network (tcp)
	MaxConnections int    `mapstructure:"max_connections" json:"max_connections" yaml:"max_connections"` // Network (tcp)
	// TLS is under active security review and is not ready for general use.
	TLS        *TLSListenerConfig `mapstructure:"tls" json:"tls,omitempty" yaml:"tls,omitempty"`
	AllowedIPs StringSliceField   `mapstructure:"allowed_ips" json:"allowed_ips,omitempty" yaml:"allowed_ips,omitempty"` // Network (tcp, udp)
	DeniedIPs  StringSliceField   `mapstructure:"denied_ips" json:"denied_ips,omitempty" yaml:"denied_ips,omitempty"`    // Network (tcp, udp)
	Path       string             // File, Journald

	Encoding     string           `mapstructure:"encoding" json:"encoding" yaml:"encoding"`                   // File
	ExcludePaths StringSliceField `mapstructure:"exclude_paths" json:"exclude_paths" yaml:"exclude_paths"`    // File
	TailingMode  string           `mapstructure:"start_position" json:"start_position" yaml:"start_position"` // File
	Format       string           `mapstructure:"format" json:"format" yaml:"format"`                         // Parsing format: "syslog" or "" (unstructured)

	ConfigID           string           `mapstructure:"config_id" json:"config_id" yaml:"config_id"`                            // Journald
	IncludeSystemUnits StringSliceField `mapstructure:"include_units" json:"include_units" yaml:"include_units"`                // Journald
	ExcludeSystemUnits StringSliceField `mapstructure:"exclude_units" json:"exclude_units" yaml:"exclude_units"`                // Journald
	IncludeUserUnits   StringSliceField `mapstructure:"include_user_units" json:"include_user_units" yaml:"include_user_units"` // Journald
	ExcludeUserUnits   StringSliceField `mapstructure:"exclude_user_units" json:"exclude_user_units" yaml:"exclude_user_units"` // Journald
	IncludeMatches     StringSliceField `mapstructure:"include_matches" json:"include_matches" yaml:"include_matches"`          // Journald
	ExcludeMatches     StringSliceField `mapstructure:"exclude_matches" json:"exclude_matches" yaml:"exclude_matches"`          // Journald
	ContainerMode      bool             `mapstructure:"container_mode" json:"container_mode" yaml:"container_mode"`             // Journald
	// Intentionally nillable string, as journald will decide on non-standard defaults if the field is not set.
	DefaultApplicationName *string `mapstructure:"default_application_name" json:"default_application_name" yaml:"default_application_name"` // Journald

	Image string // Docker
	Label string // Docker
	// Name contains the container name
	Name string // Docker
	// Identifier contains the container ID.  This is also set for File sources and used to
	// determine the appropriate tags for the logs.
	Identifier string // Docker, File

	ChannelPath string `mapstructure:"channel_path" json:"channel_path" yaml:"channel_path"` // Windows Event
	Query       string // Windows Event

	// used as input only by the Channel tailer.
	// could have been unidirectional but the tailer could not close it in this case.
	Channel chan *ChannelMessage

	// ChannelTags are the tags attached to messages on Channel; unlike Tags this can be
	// modified at runtime (as long as ChannelTagsMutex is held).
	ChannelTags StringSliceField

	// ChannelTagsMutex guards ChannelTags.
	ChannelTagsMutex sync.Mutex

	Service         string
	Source          string
	SourceCategory  string
	Tags            StringSliceField
	ProcessingRules []*ProcessingRule `mapstructure:"log_processing_rules" json:"log_processing_rules" yaml:"log_processing_rules"`
	// ProcessRawMessage is used to process the raw message instead of only the content part of the message.
	ProcessRawMessage *bool `mapstructure:"process_raw_message" json:"process_raw_message" yaml:"process_raw_message"`

	// SIEMParsing enables CEF/LEEF header detection and extraction within syslog
	// message bodies. When true (the default once syslog ingestion is wired up),
	// syslog messages whose body starts with "CEF:" or "LEEF:" are parsed into
	// structured SIEM fields. Set to false to skip this detection and treat the
	// message body as plain text. See IsSIEMParsingEnabled() for nil handling.
	SIEMParsing *bool `mapstructure:"siem_parsing" json:"siem_parsing" yaml:"siem_parsing"`

	AutoMultiLine               *bool   `mapstructure:"auto_multi_line_detection" json:"auto_multi_line_detection" yaml:"auto_multi_line_detection"`
	AutoMultiLineSampleSize     int     `mapstructure:"auto_multi_line_sample_size" json:"auto_multi_line_sample_size" yaml:"auto_multi_line_sample_size"`
	AutoMultiLineMatchThreshold float64 `mapstructure:"auto_multi_line_match_threshold" json:"auto_multi_line_match_threshold" yaml:"auto_multi_line_match_threshold"`
	// AutoMultiLineOptions provides detailed configuration for auto multi-line detection specific to this source.
	// It maps to the 'auto_multi_line' key in the YAML configuration.
	AutoMultiLineOptions *SourceAutoMultiLineOptions `mapstructure:"auto_multi_line" json:"auto_multi_line" yaml:"auto_multi_line"`
	// ExperimentalAdaptiveSampling provides per-source overrides for the experimental adaptive sampler.
	// It maps to the 'experimental_adaptive_sampling' key in the YAML configuration.
	ExperimentalAdaptiveSampling *SourceAdaptiveSamplingOptions `mapstructure:"experimental_adaptive_sampling" json:"experimental_adaptive_sampling" yaml:"experimental_adaptive_sampling"`
	// ExperimentalNoisyLogDetection overrides the global noisy log detection toggle for this source when set.
	ExperimentalNoisyLogDetection *bool `` /* 127-byte string literal not displayed */
	// CustomSamples holds the raw string content of the 'auto_multi_line_detection_custom_samples' YAML block.
	// Downstream code will be responsible for parsing this string.
	AutoMultiLineSamples []*AutoMultilineSample   `` /* 151-byte string literal not displayed */
	FingerprintConfig    *types.FingerprintConfig `mapstructure:"fingerprint_config" json:"fingerprint_config" yaml:"fingerprint_config"`

	// MaxMessageSizeBytes overrides the global logs_config.max_message_size_bytes for this source.
	// If nil, the global setting is used.
	MaxMessageSizeBytes *int `mapstructure:"max_message_size_bytes" json:"max_message_size_bytes" yaml:"max_message_size_bytes"`

	// IntegrationSource is the source of the integration file that contains this source.
	IntegrationSource string `mapstructure:"integration_source" json:"integration_source" yaml:"integration_source"`
	// IntegrationFileIndex is the index of the integration file that contains this source.
	IntegrationSourceIndex int `mapstructure:"integration_source_index" json:"integration_source_index" yaml:"integration_source_index"`
}

type LogsConfigKeys struct {
	// contains filtered or unexported fields
}

type Messages struct {
	// contains filtered or unexported fields
}

type ProcessingRule struct {
	Type               string
	Name               string
	ReplacePlaceholder string `mapstructure:"replace_placeholder" json:"replace_placeholder" yaml:"replace_placeholder"`
	Pattern            string
	Regex              *regexp.Regexp
	Placeholder        []byte
	Matching           []*SourceMatchEntry `mapstructure:"matching" json:"matching" yaml:"matching"`
}

type SourceAdaptiveSamplingOptions struct {
	// Enabled overrides the global adaptive sampling toggle for this source when set.
	Enabled *bool `mapstructure:"enabled" json:"enabled" yaml:"enabled"`

	// MaxPatterns overrides the maximum number of patterns tracked for this source when set.
	MaxPatterns *int `mapstructure:"max_patterns" json:"max_patterns" yaml:"max_patterns"`

	// RateLimit overrides the steady-state logs per second allowed per pattern for this source when set.
	RateLimit *float64 `mapstructure:"rate_limit" json:"rate_limit" yaml:"rate_limit"`

	// BurstSize overrides the maximum accumulated credits per pattern for this source when set.
	BurstSize *float64 `mapstructure:"burst_size" json:"burst_size" yaml:"burst_size"`

	// MatchThreshold overrides the token match threshold for this source when set.
	MatchThreshold *float64 `mapstructure:"match_threshold" json:"match_threshold" yaml:"match_threshold"`

	// TokenizerMaxInputBytes overrides the sampler tokenizer minimum input bytes for this source when set.
	TokenizerMaxInputBytes *int `mapstructure:"tokenizer_max_input_bytes" json:"tokenizer_max_input_bytes" yaml:"tokenizer_max_input_bytes"`

	// ProtectImportantLogs overrides whether important logs bypass adaptive sampling for this source when set.
	ProtectImportantLogs *bool `mapstructure:"protect_important_logs" json:"protect_important_logs" yaml:"protect_important_logs"`

	// TagPatternHash overrides whether logs are tagged with their sampler pattern hash for this source when set.
	TagPatternHash *bool `mapstructure:"tag_pattern_hash" json:"tag_pattern_hash" yaml:"tag_pattern_hash"`

	// Include limits adaptive sampling to logs matching at least one rule when set.
	Include []*AdaptiveSamplingRule `mapstructure:"include" json:"include" yaml:"include"`

	// Exclude prevents adaptive sampling from applying to logs matching any rule when set.
	Exclude []*AdaptiveSamplingRule `mapstructure:"exclude" json:"exclude" yaml:"exclude"`
}

type SourceAutoMultiLineOptions struct {
	// EnableJSONDetection allows to enable or disable the detection of multi-line JSON logs for this source.
	EnableJSONDetection *bool `mapstructure:"enable_json_detection" json:"enable_json_detection" yaml:"enable_json_detection"`

	// EnableDatetimeDetection allows to enable or disable the detection of multi-lines based on leading datetime stamps for this source.
	EnableDatetimeDetection *bool `mapstructure:"enable_datetime_detection" json:"enable_datetime_detection" yaml:"enable_datetime_detection"`

	// MatchThreshold sets the similarity threshold to consider a pattern match for this source.
	TimestampDetectorMatchThreshold *float64 `` /* 133-byte string literal not displayed */

	// TokenizerMaxInputBytes sets the maximum number of bytes the tokenizer will read for this source.
	TokenizerMaxInputBytes *int `mapstructure:"tokenizer_max_input_bytes" json:"tokenizer_max_input_bytes" yaml:"tokenizer_max_input_bytes"`

	// PatternTableMaxSize sets the number of patterns auto multi line can use
	PatternTableMaxSize *int `mapstructure:"pattern_table_max_size" json:"pattern_table_max_size" yaml:"pattern_table_max_size"`

	// PatternTableMatchThreshold sets the threshold for pattern table match for this source.
	PatternTableMatchThreshold *float64 `mapstructure:"pattern_table_match_threshold" json:"pattern_table_match_threshold" yaml:"pattern_table_match_threshold"`

	// EnableJSONAggregation allows to enable or disable the aggregation of multi-line JSON logs for this source.
	EnableJSONAggregation *bool `mapstructure:"enable_json_aggregation" json:"enable_json_aggregation" yaml:"enable_json_aggregation"`

	// TagAggregatedJSON allows to enable or disable the tagging of aggregated JSON logs for this source.
	TagAggregatedJSON *bool `mapstructure:"tag_aggregated_json" json:"tag_aggregated_json" yaml:"tag_aggregated_json"`

	// StackTraceParsers overrides the list of enabled stack trace parsers for this source.
	// Valid names match keys in the parser registry (e.g. "go"). An empty list disables
	// stack trace aggregation for this source.
	StackTraceParsers *[]string `mapstructure:"stack_trace_parsers" json:"stack_trace_parsers" yaml:"stack_trace_parsers"`
}

type SourceMatchEntry struct {
	Attribute string `mapstructure:"attribute" json:"attribute" yaml:"attribute"`
	Value     string `mapstructure:"value" json:"value" yaml:"value"`
	NewSource string `mapstructure:"new_source" json:"new_source" yaml:"new_source"`
}

type StringSliceField []string

type TLSListenerConfig struct {
	CertFile      string `mapstructure:"cert_file" json:"cert_file" yaml:"cert_file"`
	KeyFile       string `mapstructure:"key_file" json:"key_file" yaml:"key_file"`
	CAFile        string `mapstructure:"ca_file" json:"ca_file" yaml:"ca_file"`
	ClientAuth    string `mapstructure:"client_auth" json:"client_auth" yaml:"client_auth"`
	MinTLSVersion string `mapstructure:"min_tls_version" json:"min_tls_version" yaml:"min_tls_version"`
}

type TailingMode uint8