service:
  flush: 1
  daemon: off
  log_level: warning
  parsers_file: /opt/fluent-bit/etc/fluent-bit/parsers.yaml

pipeline:
  inputs:
    # -----------------------
    # Intune log files
    # -----------------------
    - name: tail
      tag: remote.macos.tail
      path: /Library/Logs/Intune/*.log
      refresh_interval: 1
      parser: intune_mdm_daemon
      path_key: source_path
      db: /opt/fluent-bit/var/intune-tail-state.db
      read_from_head: true

    - name: tail
      tag: remote.macos.tail
      path: /Library/Logs/IntuneScripts/Octory/Octory.log
      refresh_interval: 1
      skip_long_lines: true
      path_key: source_path
      db: /opt/fluent-bit/var/octory-tail-state.db
      read_from_head: true

    # -----------------------
    # Unified log streams (JSON)
    # -----------------------
    - name: exec
      tag: remote.macos.unified
      command: /usr/bin/log stream --style ndjson --predicate '(subsystem == "com.apple.ManagedClient") OR (subsystem == "com.apple.authd") OR (subsystem == "com.apple.TCC") OR (process == "syspolicyd") OR (process == "sudo") OR (message BEGINSWITH "SAPCorp:")'
      threaded: true

  filters:
    # -----------------------
    # 1) Attach stable device metadata to EVERYTHING
    # -----------------------
    - name: modify
      match: remote.macos*
      set:
        - device_id "<DEVICE_ID>"
        - serial "<SERIAL>"
        - hostname "<HOSTNAME>"
        - platform "macos"

    # -----------------------
    # 2) Normalize TAIL events:
    # Tail creates "log" -> we rename to "message"
    # Also mark source as "file"
    # -----------------------
    - name: modify
      match: remote.macos.tail
      rename:
        - log message
    # -----------------------
    # 3) Parse EXEC (log stream) events as JSON
    # -----------------------
    - name: parser
      match: remote.macos.unified
      key_name: exec
      parser: json
      reserve_data: true
    # -----------------------
    # 3) Normalize EXEC (log stream) JSON events:
    # They don't have "log". They usually have "eventMessage" (and many other fields).
    # We'll create message = eventMessage when present, else fall back to a compact string.
    #
    # This is easiest with a Lua filter so we can handle missing keys safely.
    # -----------------------
    - name: lua
      match: remote.macos.unified
      script: /opt/fluent-bit/etc/fluent-bit/normalize_unified_log_macos.lua
      call: normalize_macos

  outputs:
    - name: http
      match: remote.macos*
      host: charon.dc.kau.se
      port: 443
      uri: /remote.macos
      tls: on
      format: json
      net.dns.resolver: legacy

      # Important: keep these as literal strings
      header:
        - X-Device-Id <DEVICE_ID>
        - X-Platform macos
        - X-Serial <SERIAL>
        - X-Log-Token <TOKEN>