{
  "name": "gitlab",
  "title": "GitLab",
  "version": "2.6.0",
  "release": "ga",
  "description": "Collect logs from GitLab with Elastic Agent.",
  "type": "integration",
  "download": "/epr/gitlab/gitlab-2.6.0.zip",
  "path": "/package/gitlab/2.6.0",
  "icons": [
    {
      "src": "/img/gitlab-logo.svg",
      "path": "/package/gitlab/2.6.0/img/gitlab-logo.svg",
      "title": "gitlab Logo",
      "size": "32x32",
      "type": "image/svg+xml"
    }
  ],
  "conditions": {
    "kibana": {
      "version": "^8.13.0 || ^9.0.0"
    }
  },
  "owner": {
    "type": "elastic",
    "github": "elastic/security-service-integrations"
  },
  "categories": [
    "security",
    "productivity_security"
  ],
  "signature_path": "/epr/gitlab/gitlab-2.6.0.zip.sig",
  "format_version": "3.1.3",
  "readme": "/package/gitlab/2.6.0/docs/README.md",
  "license": "basic",
  "screenshots": [
    {
      "src": "/img/gitlab-api-dashboard.png",
      "path": "/package/gitlab/2.6.0/img/gitlab-api-dashboard.png",
      "title": "GitLab api overview",
      "size": "600x600",
      "type": "image/png"
    },
    {
      "src": "/img/gitlab-production-dashboard.png",
      "path": "/package/gitlab/2.6.0/img/gitlab-production-dashboard.png",
      "title": "GitLab production overview",
      "size": "600x600",
      "type": "image/png"
    },
    {
      "src": "/img/gitlab-application-dashboard.png",
      "path": "/package/gitlab/2.6.0/img/gitlab-application-dashboard.png",
      "title": "GitLab application overview",
      "size": "600x600",
      "type": "image/png"
    },
    {
      "src": "/img/gitlab-auth-dashboard.png",
      "path": "/package/gitlab/2.6.0/img/gitlab-auth-dashboard.png",
      "title": "GitLab auth overview",
      "size": "600x600",
      "type": "image/png"
    }
  ],
  "assets": [
    "/package/gitlab/2.6.0/LICENSE.txt",
    "/package/gitlab/2.6.0/changelog.yml",
    "/package/gitlab/2.6.0/manifest.yml",
    "/package/gitlab/2.6.0/docs/README.md",
    "/package/gitlab/2.6.0/img/gitlab-api-dashboard.png",
    "/package/gitlab/2.6.0/img/gitlab-application-dashboard.png",
    "/package/gitlab/2.6.0/img/gitlab-auth-dashboard.png",
    "/package/gitlab/2.6.0/img/gitlab-logo.svg",
    "/package/gitlab/2.6.0/img/gitlab-production-dashboard.png",
    "/package/gitlab/2.6.0/data_stream/api/manifest.yml",
    "/package/gitlab/2.6.0/data_stream/api/sample_event.json",
    "/package/gitlab/2.6.0/data_stream/application/manifest.yml",
    "/package/gitlab/2.6.0/data_stream/application/sample_event.json",
    "/package/gitlab/2.6.0/data_stream/audit/manifest.yml",
    "/package/gitlab/2.6.0/data_stream/audit/sample_event.json",
    "/package/gitlab/2.6.0/data_stream/auth/manifest.yml",
    "/package/gitlab/2.6.0/data_stream/auth/sample_event.json",
    "/package/gitlab/2.6.0/data_stream/pages/manifest.yml",
    "/package/gitlab/2.6.0/data_stream/pages/sample_event.json",
    "/package/gitlab/2.6.0/data_stream/production/manifest.yml",
    "/package/gitlab/2.6.0/data_stream/production/sample_event.json",
    "/package/gitlab/2.6.0/data_stream/sidekiq/manifest.yml",
    "/package/gitlab/2.6.0/data_stream/sidekiq/sample_event.json",
    "/package/gitlab/2.6.0/kibana/dashboard/gitlab-474c2c79-8777-4fe6-aa0a-232feb1cbee9.json",
    "/package/gitlab/2.6.0/kibana/dashboard/gitlab-6b62c186-77b6-49f2-a820-ca377575bb96.json",
    "/package/gitlab/2.6.0/kibana/dashboard/gitlab-8af75511-17ac-441f-a8e7-b8bd6a341629.json",
    "/package/gitlab/2.6.0/kibana/dashboard/gitlab-e21a3664-0856-4ad9-83ce-e5e86397c21b.json",
    "/package/gitlab/2.6.0/data_stream/api/fields/agent.yml",
    "/package/gitlab/2.6.0/data_stream/api/fields/base-fields.yml",
    "/package/gitlab/2.6.0/data_stream/api/fields/beats.yml",
    "/package/gitlab/2.6.0/data_stream/api/fields/fields.yml",
    "/package/gitlab/2.6.0/data_stream/application/fields/agent.yml",
    "/package/gitlab/2.6.0/data_stream/application/fields/base-fields.yml",
    "/package/gitlab/2.6.0/data_stream/application/fields/beats.yml",
    "/package/gitlab/2.6.0/data_stream/application/fields/fields.yml",
    "/package/gitlab/2.6.0/data_stream/audit/fields/agent.yml",
    "/package/gitlab/2.6.0/data_stream/audit/fields/base-fields.yml",
    "/package/gitlab/2.6.0/data_stream/audit/fields/beats.yml",
    "/package/gitlab/2.6.0/data_stream/audit/fields/fields.yml",
    "/package/gitlab/2.6.0/data_stream/auth/fields/agent.yml",
    "/package/gitlab/2.6.0/data_stream/auth/fields/base-fields.yml",
    "/package/gitlab/2.6.0/data_stream/auth/fields/beats.yml",
    "/package/gitlab/2.6.0/data_stream/auth/fields/fields.yml",
    "/package/gitlab/2.6.0/data_stream/pages/fields/agent.yml",
    "/package/gitlab/2.6.0/data_stream/pages/fields/base-fields.yml",
    "/package/gitlab/2.6.0/data_stream/pages/fields/beats.yml",
    "/package/gitlab/2.6.0/data_stream/pages/fields/fields.yml",
    "/package/gitlab/2.6.0/data_stream/production/fields/agent.yml",
    "/package/gitlab/2.6.0/data_stream/production/fields/base-fields.yml",
    "/package/gitlab/2.6.0/data_stream/production/fields/beats.yml",
    "/package/gitlab/2.6.0/data_stream/production/fields/fields.yml",
    "/package/gitlab/2.6.0/data_stream/sidekiq/fields/agent.yml",
    "/package/gitlab/2.6.0/data_stream/sidekiq/fields/base-fields.yml",
    "/package/gitlab/2.6.0/data_stream/sidekiq/fields/beats.yml",
    "/package/gitlab/2.6.0/data_stream/sidekiq/fields/fields.yml",
    "/package/gitlab/2.6.0/data_stream/api/agent/stream/filestream.yml.hbs",
    "/package/gitlab/2.6.0/data_stream/api/elasticsearch/ingest_pipeline/default.yml",
    "/package/gitlab/2.6.0/data_stream/application/agent/stream/filestream.yml.hbs",
    "/package/gitlab/2.6.0/data_stream/application/elasticsearch/ingest_pipeline/default.yml",
    "/package/gitlab/2.6.0/data_stream/audit/agent/stream/filestream.yml.hbs",
    "/package/gitlab/2.6.0/data_stream/audit/elasticsearch/ingest_pipeline/default.yml",
    "/package/gitlab/2.6.0/data_stream/auth/agent/stream/filestream.yml.hbs",
    "/package/gitlab/2.6.0/data_stream/auth/elasticsearch/ingest_pipeline/default.yml",
    "/package/gitlab/2.6.0/data_stream/pages/agent/stream/filestream.yml.hbs",
    "/package/gitlab/2.6.0/data_stream/pages/elasticsearch/ingest_pipeline/default.yml",
    "/package/gitlab/2.6.0/data_stream/production/agent/stream/filestream.yml.hbs",
    "/package/gitlab/2.6.0/data_stream/production/elasticsearch/ingest_pipeline/default.yml",
    "/package/gitlab/2.6.0/data_stream/sidekiq/agent/stream/filestream.yml.hbs",
    "/package/gitlab/2.6.0/data_stream/sidekiq/elasticsearch/ingest_pipeline/default.yml"
  ],
  "policy_templates": [
    {
      "name": "gitlab",
      "title": "GitLab",
      "description": "Collect logs from GitLab with Elastic Agent.",
      "inputs": [
        {
          "type": "filestream",
          "title": "Collect GitLab logs via filestream",
          "description": "Collecting logs from GitLab via filestream"
        }
      ],
      "multiple": true
    }
  ],
  "data_streams": [
    {
      "type": "logs",
      "dataset": "gitlab.api",
      "title": "GitLab API logs",
      "release": "ga",
      "ingest_pipeline": "default",
      "streams": [
        {
          "input": "filestream",
          "vars": [
            {
              "name": "paths",
              "type": "text",
              "title": "Paths",
              "description": "The full path to the related log file.",
              "multi": true,
              "required": true,
              "show_user": true,
              "default": [
                "/var/log/gitlab/gitlab-rails/api_json.log",
                "/home/git/gitlab/log/api_json.log"
              ]
            },
            {
              "name": "exclude_files",
              "type": "text",
              "title": "Exclude Files",
              "description": "A list of regular expressions to match the files that you want Filebeat to ignore.",
              "multi": false,
              "required": false,
              "show_user": true,
              "default": [
                "\\.gz$"
              ]
            },
            {
              "name": "custom",
              "type": "yaml",
              "title": "Additional Filestream Configuration Options",
              "description": "Configuration options that can be used to further change input configuration. Check the [Filebeat documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-filestream.html) for more information.",
              "multi": false,
              "required": false,
              "show_user": false,
              "default": "#encoding: plain\nprospector.scanner.recursive_glob: true\n#prospector.scanner.symlinks: true\n#prospector.scanner.include_files: ['']\n#prospector.scanner.resend_on_touch: false\n#prospector.scanner.check_interval: 10s\n#prospector.scanner.fingerprint.enabled: false\n#prospector.scanner.fingerprint.offset: 0\n#prospector.scanner.fingerprint.length: 1024\n#ignore_older: 0\n#ignore_inactive: ''\n#close.on_state_change.inactive: 5m\n#close.on_state_change.renamed: false\n#close.on_state_change.removed: false\n#close.reader.on_eof: false\n#close.reader.after_interval: 0\n#clean_inactive: 0\n#clean_removed: true\n#backoff.init: 2s\n#backoff.max: 10s\n#file_identity.native: ~\n#file_identity.path: ''\n#file_identity.inode_marker.path: ''\n#file_identity.fingerprint: ~\n#rotation.external.strategy.copytruncate.suffix_regex: '\\.\\d$'\n#rotation.external.strategy.copytruncate.dateformat: '-20060102'\n#include_lines: ['sometext']\n#exclude_lines: ['^DBG']\n#buffer_size: 16384\n#message_max_bytes: 1048576"
            },
            {
              "name": "preserve_original_event",
              "type": "bool",
              "title": "Preserve original event",
              "description": "Preserves a raw copy of the original event, added to the field `event.original`",
              "multi": false,
              "required": true,
              "show_user": true,
              "default": false
            },
            {
              "name": "tags",
              "type": "text",
              "title": "Tags",
              "multi": true,
              "required": true,
              "show_user": false,
              "default": [
                "gitlab-api"
              ]
            },
            {
              "name": "processors",
              "type": "yaml",
              "title": "Processors",
              "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.",
              "multi": false,
              "required": false,
              "show_user": false
            }
          ],
          "template_path": "filestream.yml.hbs",
          "title": "GitLab API logs",
          "description": "Collect logs for HTTP requests made to the GitLab API.",
          "enabled": true,
          "ingestion_method": "File"
        }
      ],
      "package": "gitlab",
      "path": "api"
    },
    {
      "type": "logs",
      "dataset": "gitlab.application",
      "title": "Application",
      "release": "ga",
      "ingest_pipeline": "default",
      "streams": [
        {
          "input": "filestream",
          "vars": [
            {
              "name": "paths",
              "type": "text",
              "title": "Paths",
              "multi": true,
              "required": true,
              "show_user": true,
              "default": [
                "/var/log/gitlab/gitlab-rails/application_json.log",
                "/home/git/gitlab/log/application_json.log"
              ]
            },
            {
              "name": "exclude_files",
              "type": "text",
              "title": "Exclude Files",
              "description": "A list of regular expressions to match the files that you want Filebeat to ignore.",
              "multi": false,
              "required": false,
              "show_user": true,
              "default": [
                "\\.gz$"
              ]
            },
            {
              "name": "custom",
              "type": "yaml",
              "title": "Additional Filestream Configuration Options",
              "description": "Configuration options that can be used to further change input configuration. Check the [Filebeat documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-filestream.html) for more information.",
              "multi": false,
              "required": false,
              "show_user": false,
              "default": "#encoding: plain\nprospector.scanner.recursive_glob: true\n#prospector.scanner.symlinks: true\n#prospector.scanner.include_files: ['']\n#prospector.scanner.resend_on_touch: false\n#prospector.scanner.check_interval: 10s\n#prospector.scanner.fingerprint.enabled: false\n#prospector.scanner.fingerprint.offset: 0\n#prospector.scanner.fingerprint.length: 1024\n#ignore_older: 0\n#ignore_inactive: ''\n#close.on_state_change.inactive: 5m\n#close.on_state_change.renamed: false\n#close.on_state_change.removed: false\n#close.reader.on_eof: false\n#close.reader.after_interval: 0\n#clean_inactive: 0\n#clean_removed: true\n#backoff.init: 2s\n#backoff.max: 10s\n#file_identity.native: ~\n#file_identity.path: ''\n#file_identity.inode_marker.path: ''\n#file_identity.fingerprint: ~\n#rotation.external.strategy.copytruncate.suffix_regex: '\\.\\d$'\n#rotation.external.strategy.copytruncate.dateformat: '-20060102'\n#include_lines: ['sometext']\n#exclude_lines: ['^DBG']\n#buffer_size: 16384\n#message_max_bytes: 1048576"
            },
            {
              "name": "tags",
              "type": "text",
              "title": "Tags",
              "multi": true,
              "required": true,
              "show_user": false,
              "default": [
                "gitlab-application"
              ]
            },
            {
              "name": "preserve_original_event",
              "type": "bool",
              "title": "Preserve original event",
              "description": "Preserves a raw copy of the original event, added to the field `event.original`",
              "multi": false,
              "required": true,
              "show_user": true,
              "default": false
            },
            {
              "name": "processors",
              "type": "yaml",
              "title": "Processors",
              "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.\n",
              "multi": false,
              "required": false,
              "show_user": false
            }
          ],
          "template_path": "filestream.yml.hbs",
          "title": "GitLab Application logs",
          "description": "Collect GitLab Application logs",
          "enabled": true,
          "ingestion_method": "File"
        }
      ],
      "package": "gitlab",
      "path": "application"
    },
    {
      "type": "logs",
      "dataset": "gitlab.audit",
      "title": "Audit",
      "release": "ga",
      "ingest_pipeline": "default",
      "streams": [
        {
          "input": "filestream",
          "vars": [
            {
              "name": "paths",
              "type": "text",
              "title": "Paths",
              "multi": true,
              "required": true,
              "show_user": true,
              "default": [
                "/var/log/gitlab/gitlab-rails/audit_json.log",
                "/home/git/gitlab/log/audit_json.log"
              ]
            },
            {
              "name": "exclude_files",
              "type": "text",
              "title": "Exclude Files",
              "description": "A list of regular expressions to match the files that you want Filebeat to ignore.",
              "multi": false,
              "required": false,
              "show_user": true,
              "default": [
                "\\.gz$"
              ]
            },
            {
              "name": "custom",
              "type": "yaml",
              "title": "Additional Filestream Configuration Options",
              "description": "Configuration options that can be used to further change input configuration. Check the [Filebeat documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-filestream.html) for more information.",
              "multi": false,
              "required": false,
              "show_user": false,
              "default": "#encoding: plain\nprospector.scanner.recursive_glob: true\n#prospector.scanner.symlinks: true\n#prospector.scanner.include_files: ['']\n#prospector.scanner.resend_on_touch: false\n#prospector.scanner.check_interval: 10s\n#prospector.scanner.fingerprint.enabled: false\n#prospector.scanner.fingerprint.offset: 0\n#prospector.scanner.fingerprint.length: 1024\n#ignore_older: 0\n#ignore_inactive: ''\n#close.on_state_change.inactive: 5m\n#close.on_state_change.renamed: false\n#close.on_state_change.removed: false\n#close.reader.on_eof: false\n#close.reader.after_interval: 0\n#clean_inactive: 0\n#clean_removed: true\n#backoff.init: 2s\n#backoff.max: 10s\n#file_identity.native: ~\n#file_identity.path: ''\n#file_identity.inode_marker.path: ''\n#file_identity.fingerprint: ~\n#rotation.external.strategy.copytruncate.suffix_regex: '\\.\\d$'\n#rotation.external.strategy.copytruncate.dateformat: '-20060102'\n#include_lines: ['sometext']\n#exclude_lines: ['^DBG']\n#buffer_size: 16384\n#message_max_bytes: 1048576"
            },
            {
              "name": "tags",
              "type": "text",
              "title": "Tags",
              "multi": true,
              "required": true,
              "show_user": false,
              "default": [
                "gitlab-audit"
              ]
            },
            {
              "name": "preserve_original_event",
              "type": "bool",
              "title": "Preserve original event",
              "description": "Preserves a raw copy of the original event, added to the field `event.original`",
              "multi": false,
              "required": true,
              "show_user": true,
              "default": false
            },
            {
              "name": "processors",
              "type": "yaml",
              "title": "Processors",
              "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.\n",
              "multi": false,
              "required": false,
              "show_user": false
            }
          ],
          "template_path": "filestream.yml.hbs",
          "title": "GitLab Audit Logs",
          "description": "Gitlab Audit Logs",
          "enabled": true,
          "ingestion_method": "File"
        }
      ],
      "package": "gitlab",
      "path": "audit"
    },
    {
      "type": "logs",
      "dataset": "gitlab.auth",
      "title": "Auth",
      "release": "ga",
      "ingest_pipeline": "default",
      "streams": [
        {
          "input": "filestream",
          "vars": [
            {
              "name": "paths",
              "type": "text",
              "title": "Paths",
              "multi": true,
              "required": true,
              "show_user": true,
              "default": [
                "/var/log/gitlab/gitlab-rails/auth_json.log",
                "/home/git/gitlab/log/auth_json.log"
              ]
            },
            {
              "name": "exclude_files",
              "type": "text",
              "title": "Exclude Files",
              "description": "A list of regular expressions to match the files that you want Filebeat to ignore.",
              "multi": false,
              "required": false,
              "show_user": true,
              "default": [
                "\\.gz$"
              ]
            },
            {
              "name": "custom",
              "type": "yaml",
              "title": "Additional Filestream Configuration Options",
              "description": "Configuration options that can be used to further change input configuration. Check the [Filebeat documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-filestream.html) for more information.",
              "multi": false,
              "required": false,
              "show_user": false,
              "default": "#encoding: plain\nprospector.scanner.recursive_glob: true\n#prospector.scanner.symlinks: true\n#prospector.scanner.include_files: ['']\n#prospector.scanner.resend_on_touch: false\n#prospector.scanner.check_interval: 10s\n#prospector.scanner.fingerprint.enabled: false\n#prospector.scanner.fingerprint.offset: 0\n#prospector.scanner.fingerprint.length: 1024\n#ignore_older: 0\n#ignore_inactive: ''\n#close.on_state_change.inactive: 5m\n#close.on_state_change.renamed: false\n#close.on_state_change.removed: false\n#close.reader.on_eof: false\n#close.reader.after_interval: 0\n#clean_inactive: 0\n#clean_removed: true\n#backoff.init: 2s\n#backoff.max: 10s\n#file_identity.native: ~\n#file_identity.path: ''\n#file_identity.inode_marker.path: ''\n#file_identity.fingerprint: ~\n#rotation.external.strategy.copytruncate.suffix_regex: '\\.\\d$'\n#rotation.external.strategy.copytruncate.dateformat: '-20060102'\n#include_lines: ['sometext']\n#exclude_lines: ['^DBG']\n#buffer_size: 16384\n#message_max_bytes: 1048576"
            },
            {
              "name": "tags",
              "type": "text",
              "title": "Tags",
              "multi": true,
              "required": true,
              "show_user": false,
              "default": [
                "gitlab-auth"
              ]
            },
            {
              "name": "preserve_original_event",
              "type": "bool",
              "title": "Preserve original event",
              "description": "Preserves a raw copy of the original event, added to the field `event.original`",
              "multi": false,
              "required": true,
              "show_user": true,
              "default": false
            },
            {
              "name": "processors",
              "type": "yaml",
              "title": "Processors",
              "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.\n",
              "multi": false,
              "required": false,
              "show_user": false
            }
          ],
          "template_path": "filestream.yml.hbs",
          "title": "GitLab Auth Logs",
          "description": "GitLab Auth Logs",
          "enabled": true,
          "ingestion_method": "File"
        }
      ],
      "package": "gitlab",
      "path": "auth"
    },
    {
      "type": "logs",
      "dataset": "gitlab.pages",
      "title": "GitLab Pages logs",
      "release": "ga",
      "ingest_pipeline": "default",
      "streams": [
        {
          "input": "filestream",
          "vars": [
            {
              "name": "paths",
              "type": "text",
              "title": "Paths",
              "description": "The full path to the related log file.",
              "multi": true,
              "required": true,
              "show_user": true,
              "default": [
                "/var/log/gitlab/gitlab-pages/current"
              ]
            },
            {
              "name": "exclude_files",
              "type": "text",
              "title": "Exclude Files",
              "description": "A list of regular expressions to match the files that you want Filebeat to ignore.",
              "multi": false,
              "required": false,
              "show_user": true,
              "default": [
                "\\.gz$"
              ]
            },
            {
              "name": "custom",
              "type": "yaml",
              "title": "Additional Filestream Configuration Options",
              "description": "Configuration options that can be used to further change input configuration. Check the [Filebeat documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-filestream.html) for more information.",
              "multi": false,
              "required": false,
              "show_user": false,
              "default": "#encoding: plain\nprospector.scanner.recursive_glob: true\n#prospector.scanner.symlinks: true\n#prospector.scanner.include_files: ['']\n#prospector.scanner.resend_on_touch: false\n#prospector.scanner.check_interval: 10s\n#prospector.scanner.fingerprint.enabled: false\n#prospector.scanner.fingerprint.offset: 0\n#prospector.scanner.fingerprint.length: 1024\n#ignore_older: 0\n#ignore_inactive: ''\n#close.on_state_change.inactive: 5m\n#close.on_state_change.renamed: false\n#close.on_state_change.removed: false\n#close.reader.on_eof: false\n#close.reader.after_interval: 0\n#clean_inactive: 0\n#clean_removed: true\n#backoff.init: 2s\n#backoff.max: 10s\n#file_identity.native: ~\n#file_identity.path: ''\n#file_identity.inode_marker.path: ''\n#file_identity.fingerprint: ~\n#rotation.external.strategy.copytruncate.suffix_regex: '\\.\\d$'\n#rotation.external.strategy.copytruncate.dateformat: '-20060102'\n#include_lines: ['sometext']\n#exclude_lines: ['^DBG']\n#buffer_size: 16384\n#message_max_bytes: 1048576"
            },
            {
              "name": "preserve_original_event",
              "type": "bool",
              "title": "Preserve original event",
              "description": "Preserves a raw copy of the original event, added to the field `event.original`",
              "multi": false,
              "required": true,
              "show_user": true,
              "default": false
            },
            {
              "name": "tags",
              "type": "text",
              "title": "Tags",
              "multi": true,
              "required": true,
              "show_user": false,
              "default": [
                "gitlab-pages"
              ]
            },
            {
              "name": "processors",
              "type": "yaml",
              "title": "Processors",
              "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.",
              "multi": false,
              "required": false,
              "show_user": false
            }
          ],
          "template_path": "filestream.yml.hbs",
          "title": "GitLab Pages logs",
          "description": "Collect logs for Pages logs",
          "enabled": true,
          "ingestion_method": "File"
        }
      ],
      "package": "gitlab",
      "path": "pages"
    },
    {
      "type": "logs",
      "dataset": "gitlab.production",
      "title": "GitLab Production logs",
      "release": "ga",
      "ingest_pipeline": "default",
      "streams": [
        {
          "input": "filestream",
          "vars": [
            {
              "name": "paths",
              "type": "text",
              "title": "Paths",
              "description": "The full path to the related log file.",
              "multi": true,
              "required": true,
              "show_user": true,
              "default": [
                "/var/log/gitlab/gitlab-rails/production_json.log",
                "/home/git/gitlab/log/production_json.log"
              ]
            },
            {
              "name": "exclude_files",
              "type": "text",
              "title": "Exclude Files",
              "description": "A list of regular expressions to match the files that you want Filebeat to ignore.",
              "multi": false,
              "required": false,
              "show_user": true,
              "default": [
                "\\.gz$"
              ]
            },
            {
              "name": "custom",
              "type": "yaml",
              "title": "Additional Filestream Configuration Options",
              "description": "Configuration options that can be used to further change input configuration. Check the [Filebeat documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-filestream.html) for more information.",
              "multi": false,
              "required": false,
              "show_user": false,
              "default": "#encoding: plain\nprospector.scanner.recursive_glob: true\n#prospector.scanner.symlinks: true\n#prospector.scanner.include_files: ['']\n#prospector.scanner.resend_on_touch: false\n#prospector.scanner.check_interval: 10s\n#prospector.scanner.fingerprint.enabled: false\n#prospector.scanner.fingerprint.offset: 0\n#prospector.scanner.fingerprint.length: 1024\n#ignore_older: 0\n#ignore_inactive: ''\n#close.on_state_change.inactive: 5m\n#close.on_state_change.renamed: false\n#close.on_state_change.removed: false\n#close.reader.on_eof: false\n#close.reader.after_interval: 0\n#clean_inactive: 0\n#clean_removed: true\n#backoff.init: 2s\n#backoff.max: 10s\n#file_identity.native: ~\n#file_identity.path: ''\n#file_identity.inode_marker.path: ''\n#file_identity.fingerprint: ~\n#rotation.external.strategy.copytruncate.suffix_regex: '\\.\\d$'\n#rotation.external.strategy.copytruncate.dateformat: '-20060102'\n#include_lines: ['sometext']\n#exclude_lines: ['^DBG']\n#buffer_size: 16384\n#message_max_bytes: 1048576"
            },
            {
              "name": "preserve_original_event",
              "type": "bool",
              "title": "Preserve original event",
              "description": "Preserves a raw copy of the original event, added to the field `event.original`",
              "multi": false,
              "required": true,
              "show_user": true,
              "default": false
            },
            {
              "name": "tags",
              "type": "text",
              "title": "Tags",
              "multi": true,
              "required": true,
              "show_user": false,
              "default": [
                "gitlab-production"
              ]
            },
            {
              "name": "processors",
              "type": "yaml",
              "title": "Processors",
              "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.",
              "multi": false,
              "required": false,
              "show_user": false
            }
          ],
          "template_path": "filestream.yml.hbs",
          "title": "GitLab Production logs",
          "description": "Collect logs for Rails controller requests received from GitLab.",
          "enabled": true,
          "ingestion_method": "File"
        }
      ],
      "package": "gitlab",
      "path": "production"
    },
    {
      "type": "logs",
      "dataset": "gitlab.sidekiq",
      "title": "GitLab Sidekiq logs",
      "release": "ga",
      "ingest_pipeline": "default",
      "streams": [
        {
          "input": "filestream",
          "vars": [
            {
              "name": "paths",
              "type": "text",
              "title": "Paths",
              "description": "The full path to the related log file.",
              "multi": true,
              "required": true,
              "show_user": true,
              "default": [
                "/var/log/gitlab/sidekiq/current",
                "/home/git/gitlab/log/sidekiq.log"
              ]
            },
            {
              "name": "exclude_files",
              "type": "text",
              "title": "Exclude Files",
              "description": "A list of regular expressions to match the files that you want Filebeat to ignore.",
              "multi": false,
              "required": false,
              "show_user": true,
              "default": [
                "\\.gz$"
              ]
            },
            {
              "name": "custom",
              "type": "yaml",
              "title": "Additional Filestream Configuration Options",
              "description": "Configuration options that can be used to further change input configuration. Check the [Filebeat documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-filestream.html) for more information.",
              "multi": false,
              "required": false,
              "show_user": false,
              "default": "#encoding: plain\nprospector.scanner.recursive_glob: true\n#prospector.scanner.symlinks: true\n#prospector.scanner.include_files: ['']\n#prospector.scanner.resend_on_touch: false\n#prospector.scanner.check_interval: 10s\n#prospector.scanner.fingerprint.enabled: false\n#prospector.scanner.fingerprint.offset: 0\n#prospector.scanner.fingerprint.length: 1024\n#ignore_older: 0\n#ignore_inactive: ''\n#close.on_state_change.inactive: 5m\n#close.on_state_change.renamed: false\n#close.on_state_change.removed: false\n#close.reader.on_eof: false\n#close.reader.after_interval: 0\n#clean_inactive: 0\n#clean_removed: true\n#backoff.init: 2s\n#backoff.max: 10s\n#file_identity.native: ~\n#file_identity.path: ''\n#file_identity.inode_marker.path: ''\n#file_identity.fingerprint: ~\n#rotation.external.strategy.copytruncate.suffix_regex: '\\.\\d$'\n#rotation.external.strategy.copytruncate.dateformat: '-20060102'\n#include_lines: ['sometext']\n#exclude_lines: ['^DBG']\n#buffer_size: 16384\n#message_max_bytes: 1048576"
            },
            {
              "name": "preserve_original_event",
              "type": "bool",
              "title": "Preserve original event",
              "description": "Preserves a raw copy of the original event, added to the field `event.original`",
              "multi": false,
              "required": true,
              "show_user": true,
              "default": false
            },
            {
              "name": "tags",
              "type": "text",
              "title": "Tags",
              "multi": true,
              "required": true,
              "show_user": false,
              "default": [
                "gitlab-sidekiq"
              ]
            },
            {
              "name": "processors",
              "type": "yaml",
              "title": "Processors",
              "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.",
              "multi": false,
              "required": false,
              "show_user": false
            }
          ],
          "template_path": "filestream.yml.hbs",
          "title": "GitLab Sidekiq logs",
          "description": "Collect logs for Sidekiq",
          "enabled": true,
          "ingestion_method": "File"
        }
      ],
      "package": "gitlab",
      "path": "sidekiq"
    }
  ]
}