{
  "name": "mattermost",
  "title": "Mattermost",
  "version": "2.6.0",
  "release": "ga",
  "description": "Collect logs from Mattermost with Elastic Agent.",
  "type": "integration",
  "download": "/epr/mattermost/mattermost-2.6.0.zip",
  "path": "/package/mattermost/2.6.0",
  "icons": [
    {
      "src": "/img/mattermost-logo.svg",
      "path": "/package/mattermost/2.6.0/img/mattermost-logo.svg",
      "title": "Mattermost logo",
      "size": "537x535",
      "type": "image/svg+xml"
    }
  ],
  "conditions": {
    "kibana": {
      "version": "^8.13.0 || ^9.0.0"
    }
  },
  "owner": {
    "type": "community",
    "github": "elastic/security-service-integrations"
  },
  "categories": [
    "security",
    "productivity_security"
  ],
  "signature_path": "/epr/mattermost/mattermost-2.6.0.zip.sig",
  "format_version": "3.0.3",
  "readme": "/package/mattermost/2.6.0/docs/README.md",
  "license": "basic",
  "screenshots": [
    {
      "src": "/img/mattermost-audit_dashboard.png",
      "path": "/package/mattermost/2.6.0/img/mattermost-audit_dashboard.png",
      "title": "Mattermost Audit Dashboard",
      "size": "600x600",
      "type": "image/png"
    }
  ],
  "assets": [
    "/package/mattermost/2.6.0/LICENSE.txt",
    "/package/mattermost/2.6.0/changelog.yml",
    "/package/mattermost/2.6.0/manifest.yml",
    "/package/mattermost/2.6.0/validation.yml",
    "/package/mattermost/2.6.0/docs/README.md",
    "/package/mattermost/2.6.0/img/mattermost-audit_dashboard.png",
    "/package/mattermost/2.6.0/img/mattermost-logo.svg",
    "/package/mattermost/2.6.0/kibana/tags.yml",
    "/package/mattermost/2.6.0/data_stream/audit/manifest.yml",
    "/package/mattermost/2.6.0/data_stream/audit/sample_event.json",
    "/package/mattermost/2.6.0/kibana/dashboard/mattermost-55a753ac-7944-4a4e-ad5b-a7418b1a1543.json",
    "/package/mattermost/2.6.0/kibana/search/mattermost-4373bca9-5312-4f80-8c01-942bfdc2ac06.json",
    "/package/mattermost/2.6.0/data_stream/audit/fields/agent.yml",
    "/package/mattermost/2.6.0/data_stream/audit/fields/base-fields.yml",
    "/package/mattermost/2.6.0/data_stream/audit/fields/beats.yml",
    "/package/mattermost/2.6.0/data_stream/audit/fields/fields.yml",
    "/package/mattermost/2.6.0/data_stream/audit/agent/stream/stream.yml.hbs",
    "/package/mattermost/2.6.0/data_stream/audit/elasticsearch/ingest_pipeline/default.yml"
  ],
  "policy_templates": [
    {
      "name": "logs",
      "title": "Mattermost Logs",
      "description": "Collect logs from Mattermost",
      "inputs": [
        {
          "type": "logfile",
          "title": "Collect logs from Mattermost servers",
          "description": "Collect logs from Mattermost servers"
        }
      ],
      "multiple": true
    }
  ],
  "data_streams": [
    {
      "type": "logs",
      "dataset": "mattermost.audit",
      "title": "Audit Logs",
      "release": "ga",
      "ingest_pipeline": "default",
      "streams": [
        {
          "input": "logfile",
          "vars": [
            {
              "name": "paths",
              "type": "text",
              "title": "Paths",
              "multi": true,
              "required": true,
              "show_user": true
            },
            {
              "name": "tags",
              "type": "text",
              "title": "Tags",
              "multi": true,
              "required": true,
              "show_user": true,
              "default": [
                "mattermost-audit"
              ]
            },
            {
              "name": "preserve_original_event",
              "type": "bool",
              "title": "Preserve original event",
              "description": "Preserves a raw copy of the original event, added to the field `event.original`",
              "multi": false,
              "required": true,
              "show_user": true,
              "default": false
            },
            {
              "name": "processors",
              "type": "yaml",
              "title": "Processors",
              "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. \nThis executes in the agent before the logs are parsed. \nSee [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.\n",
              "multi": false,
              "required": false,
              "show_user": false
            }
          ],
          "template_path": "stream.yml.hbs",
          "title": "Audit Logs",
          "description": "Collect audit logs from Mattermost server",
          "enabled": true,
          "ingestion_method": "File"
        }
      ],
      "package": "mattermost",
      "path": "audit"
    }
  ]
}