logs

type Collection struct {
	// file based logs
	Files *Files
	// windows events
	WinEvents *Events
	// journald logs
	Journald *Journald
}

type Config struct {
	FilePath              string `file_path`
	LogGroup              string `log_group_name`
	LogStream             string `log_stream_name`
	LogGroupClass         string `log_group_class`
	TimestampFormat       string `timestamp_format`
	Timezone              string `timezone`
	MultiLineStartPattern string `multi_line_start_pattern`
	Encoding              string `encoding`
	Retention             int    `retention_in_days`
}

type EventConfig struct {
	EventName     string         `json:"event_name"`
	EventLevels   []string       `json:"event_levels"`
	EventIDs      []int          `json:"event_ids"`
	Filters       []*EventFilter `json:"filters"`
	EventFormat   string         `json:"event_format"`
	LogGroup      string         `json:"log_group_name"`
	LogStream     string         `json:"log_stream_name"`
	LogGroupClass string         `json:"log_group_class"`
	Retention     int            `json:"retention_in_days"`
}

type EventFilter struct {
	Type       string `json:"type"`
	Expression string `json:"expression"`
}

type Events struct {
	EventConfigs []*EventConfig
}

type Files struct {
	FileConfigs []*Config
}

type Journald struct {
	JournaldConfigs []*JournaldConfig
}

type JournaldConfig struct {
	LogGroup        string              `json:"log_group_name"`
	LogStream       string              `json:"log_stream_name"`
	Units           []string            `json:"units"`
	Priority        string              `json:"priority"`
	Matches         []map[string]string `json:"matches"`
	Filters         []*JournaldFilter   `json:"filters"`
	RetentionInDays int                 `json:"retention_in_days"`
}

type JournaldFilter struct {
	Type       string `json:"type"`
	Expression string `json:"expression"`
}