---
# ----------------------------------------------------------------------------
# Service Commissioning File
# ----------------------------------------------------------------------------
# Copyright: Cybus GmbH
# Contact: support@cybus.io
# ----------------------------------------------------------------------------
# Splunk Integration (Example)
# ----------------------------------------------------------------------------

description: >
  Service commissioning file for streaming shop floor events from
  Connectware to Splunk through the HTTP Event Collector (Example)

metadata:
  name: Splunk Integration
  provider: cybus
  homepage: https://www.cybus.io
  version: 1.0.0

parameters:
  splunkHost:
    description: Hostname of your Splunk instance, without the scheme
    type: string
    default: splunk.example.com

  splunkPort:
    description: HEC port, 8088 for Splunk Enterprise, 443 for Splunk Cloud Platform
    type: number
    default: 8088

  hecToken:
    description: HEC token used to authenticate event submissions
    type: string

  splunkIndex:
    description: Splunk index that receives the events
    type: string
    default: main

  topicRoot:
    description: Root of the MQTT topic hierarchy
    type: string
    default: enterprise

resources:
  # Connection to the Splunk HTTP Event Collector
  splunkConnection:
    type: Cybus::Connection
    properties:
      protocol: Http
      connection:
        scheme: https
        host: !ref splunkHost
        port: !ref splunkPort
        headers:
          Authorization: !sub 'Splunk ${hecToken}'
        probePath: /services/collector/health
        probeMethod: GET
        # On Splunk Enterprise, HEC uses a self-signed certificate by default.
        # Provide your CA certificate, or accept any certificate in test
        # environments only:
        # caCert: <Base64-encoded PEM content of your CA certificate>
        # trustAllCertificates: true

  # Sends one HEC event envelope per POST request
  eventEndpoint:
    type: Cybus::Endpoint
    properties:
      protocol: Http
      connection: !ref splunkConnection
      write:
        path: /services/collector/event

  # Wraps every machine event in the HEC JSON envelope
  eventMapping:
    type: Cybus::Mapping
    properties:
      mappings:
        - subscribe:
            topic: !sub '${topicRoot}/+site/+area/+line/+cell/events'
          publish:
            endpoint: !ref eventEndpoint
          rules:
            - transform:
                expression: !sub |
                  {
                    "body": {
                      "event": $,
                      "time": $millis() / 1000,
                      "host": $context.vars.cell,
                      "source": "connectware",
                      "sourcetype": "connectware:event",
                      "index": "${splunkIndex}",
                      "fields": {
                        "site": $context.vars.site,
                        "area": $context.vars.area,
                        "line": $context.vars.line,
                        "cell": $context.vars.cell
                      }
                    }
                  }
