constants

const (
	// known fields (all other fields are put into the properties map)
	TemplateFieldIndex  = "index"
	TemplateFieldYear   = "year"
	TemplateFieldMonth  = "month"
	TemplateFieldDay    = "day"
	TemplateFieldHour   = "hour"
	TemplateFieldMinute = "minute"
	TemplateFieldSecond = "second"
)

const (
	ConfigTypeConnection = "connection"
	ConfigTypeFormat     = "format"
	ConfigTypeSource     = "source"
)

const (
	SourceFormatDelimited = "delimited"
	SourceFormatJsonl     = "jsonl"
	SourceFormatRegex     = "regex"
	SourceFormatGrok      = "grok"
)

const (
	TpID              = "tp_id"
	TpSourceType      = "tp_source_type"
	TpSourceName      = "tp_source_name"
	TpSourceLocation  = "tp_source_location"
	TpIngestTimestamp = "tp_ingest_timestamp"
	TpTimestamp       = "tp_timestamp"
	TpSourceIP        = "tp_source_ip"
	TpDestinationIP   = "tp_destination_ip"
	TpTable           = "tp_table"
	TpPartition       = "tp_partition"
	TpIndex           = "tp_index"
	TpDate            = "tp_date"
	TpAkas            = "tp_akas"
	TpIps             = "tp_ips"
	TpTags            = "tp_tags"
	TpDomains         = "tp_domains"
	TpEmails          = "tp_emails"
	TpUsernames       = "tp_usernames"
)

const ArtifactSourceIdentifier = "artifact"

const DefaultInitialCollectionPeriod = 7 * 24 * time.Hour