{
  "name": "tcp",
  "title": "Custom TCP Logs",
  "version": "1.20.0",
  "release": "ga",
  "description": "Collect raw TCP data from listening TCP port with Elastic Agent.",
  "type": "integration",
  "download": "/epr/tcp/tcp-1.20.0.zip",
  "path": "/package/tcp/1.20.0",
  "icons": [
    {
      "src": "/img/icon.svg",
      "path": "/package/tcp/1.20.0/img/icon.svg",
      "type": "image/svg+xml"
    }
  ],
  "conditions": {
    "kibana": {
      "version": "^8.2.1"
    }
  },
  "owner": {
    "type": "elastic",
    "github": "elastic/sec-deployment-and-devices"
  },
  "categories": [
    "custom",
    "custom_logs"
  ],
  "signature_path": "/epr/tcp/tcp-1.20.0.zip.sig",
  "format_version": "3.0.3",
  "readme": "/package/tcp/1.20.0/docs/README.md",
  "license": "basic",
  "assets": [
    "/package/tcp/1.20.0/LICENSE.txt",
    "/package/tcp/1.20.0/changelog.yml",
    "/package/tcp/1.20.0/manifest.yml",
    "/package/tcp/1.20.0/validation.yml",
    "/package/tcp/1.20.0/docs/README.md",
    "/package/tcp/1.20.0/img/icon.svg",
    "/package/tcp/1.20.0/kibana/tags.yml",
    "/package/tcp/1.20.0/data_stream/generic/manifest.yml",
    "/package/tcp/1.20.0/data_stream/generic/sample_event.json",
    "/package/tcp/1.20.0/data_stream/generic/fields/base-fields.yml",
    "/package/tcp/1.20.0/data_stream/generic/fields/beats.yml",
    "/package/tcp/1.20.0/data_stream/generic/fields/ecs.yml",
    "/package/tcp/1.20.0/data_stream/generic/agent/stream/tcp.yml.hbs"
  ],
  "policy_templates": [
    {
      "name": "tcp",
      "title": "Custom TCP Logs",
      "description": "Collect raw TCP data from listening TCP port with Elastic Agent.",
      "inputs": [
        {
          "type": "tcp",
          "title": "Custom TCP Logs",
          "description": "Collect raw TCP data from listening TCP port with Elastic Agent."
        }
      ],
      "multiple": true
    }
  ],
  "data_streams": [
    {
      "type": "logs",
      "dataset": "tcp.generic",
      "title": "Custom TCP Logs",
      "release": "ga",
      "streams": [
        {
          "input": "tcp",
          "vars": [
            {
              "name": "listen_address",
              "type": "text",
              "title": "Listen Address",
              "description": "Bind address for the listener. Use 0.0.0.0 to listen on all interfaces.\n",
              "multi": false,
              "required": true,
              "show_user": true,
              "default": "localhost"
            },
            {
              "name": "listen_port",
              "type": "text",
              "title": "Listen port",
              "description": "Bind port for the listener.\n",
              "multi": false,
              "required": true,
              "show_user": true,
              "default": 8080
            },
            {
              "name": "data_stream.dataset",
              "type": "text",
              "title": "Dataset name",
              "description": "Dataset to write data to. Changing the dataset will send the data to a different index. You can't use `-` in the name of a dataset and only valid characters for [Elasticsearch index names](https://www.elastic.co/guide/en/elasticsearch/reference/current/docs-index_.html).\n",
              "multi": false,
              "required": true,
              "show_user": true,
              "default": "tcp.generic"
            },
            {
              "name": "pipeline",
              "type": "text",
              "title": "Ingest Pipeline",
              "description": "The Ingest Node pipeline ID to be used by the integration.\n",
              "multi": false,
              "required": false,
              "show_user": true
            },
            {
              "name": "max_message_size",
              "type": "text",
              "title": "Max Message Size",
              "description": "The maximum size of the message received over TCP. The default is 20MiB",
              "multi": false,
              "required": false,
              "show_user": false
            },
            {
              "name": "framing",
              "type": "text",
              "title": "Framing",
              "description": "Specify the framing used to split incoming events. Can be one of delimiter or rfc6587. The default is delimiter",
              "multi": false,
              "required": false,
              "show_user": false
            },
            {
              "name": "line_delimiter",
              "type": "text",
              "title": "Line Delimiter",
              "description": "Specify the characters used to split the incoming events. The default is \\n.",
              "multi": false,
              "required": false,
              "show_user": false
            },
            {
              "name": "max_connections",
              "type": "text",
              "title": "Max Connections",
              "description": "The at most number of connections to accept at any given point in time.",
              "multi": false,
              "required": false,
              "show_user": false
            },
            {
              "name": "timeout",
              "type": "text",
              "title": "Timeout",
              "description": "The duration of inactivity before a remote connection is closed. The default is 300s. Valid time units are ns, us, ms, s, m, h.",
              "multi": false,
              "required": false,
              "show_user": false
            },
            {
              "name": "keep_null",
              "type": "bool",
              "title": "Keep Null Values",
              "description": "If this option is set to true, fields with null values will be published in the output document. By default, keep_null is set to false.",
              "multi": false,
              "required": false,
              "show_user": false
            },
            {
              "name": "processors",
              "type": "yaml",
              "title": "Processors",
              "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.\n",
              "multi": false,
              "required": false,
              "show_user": false
            },
            {
              "name": "tags",
              "type": "text",
              "title": "Tags",
              "description": "Tags to include in the published event",
              "multi": true,
              "required": false,
              "show_user": true
            },
            {
              "name": "syslog",
              "type": "bool",
              "title": "Syslog Parsing",
              "description": "Enable the syslog parser to automatically parse RFC3164 and RFC5424 syslog formatted data. The syslog parser can be configured under Advanced Options.",
              "multi": false,
              "required": false,
              "show_user": true
            },
            {
              "name": "syslog_options",
              "type": "yaml",
              "title": "Syslog Configuration",
              "description": "i.e. field, format, time zone, etc. See [Syslog](https://www.elastic.co/guide/en/beats/filebeat/current/syslog.html) for details.",
              "multi": false,
              "required": false,
              "show_user": false,
              "default": "field: message\n#format: auto\n#timezone: Local\n"
            },
            {
              "name": "preserve_original_event",
              "type": "bool",
              "title": "Preserve original event",
              "description": "Preserves a raw copy of the original event, added to the field `event.original`.",
              "multi": false,
              "required": true,
              "show_user": true,
              "default": false
            },
            {
              "name": "ssl",
              "type": "yaml",
              "title": "SSL Configuration",
              "description": "i.e. certificate, keys, supported_protocols, verification_mode etc. See [SSL](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-server-config) for details.",
              "multi": false,
              "required": false,
              "show_user": false,
              "default": "#certificate: |\n#    -----BEGIN CERTIFICATE-----\n#    ...\n#    -----END CERTIFICATE-----\n#key: |\n#    -----BEGIN PRIVATE KEY-----\n#    ...\n#    -----END PRIVATE KEY-----\n"
            },
            {
              "name": "custom",
              "type": "yaml",
              "title": "Custom configurations",
              "description": "Here YAML configuration options can be used to be added to your configuration. Be careful using this as it might break your configuration file.\n",
              "multi": false,
              "required": false,
              "show_user": false,
              "default": ""
            }
          ],
          "template_path": "tcp.yml.hbs",
          "title": "Custom TCP Logs",
          "description": "Collect raw TCP data from listening TCP port with Elastic Agent.",
          "enabled": true,
          "ingestion_method": "Network Protocol"
        }
      ],
      "package": "tcp",
      "elasticsearch": {},
      "path": "generic"
    }
  ]
}