Input Configurations

input-configurations

When to use

Load this skill whenever tasks include:

• building, modifying, or reviewing agent/stream/*.yml.hbs templates for non-CEL input types
• configuring request, response, pagination, cursor, or authentication blocks in HTTPJSON templates
• wiring up cloud storage inputs (AWS S3, GCS, Azure Blob, Azure EventHub)
• setting up network inputs (TCP, UDP, HTTP Endpoint, WebSocket)
• configuring file-based inputs (Filestream, Logfile, Journald, Winlog)
• enabling Federated Identity (Cloud Connectors) on an AWS integration package

When not to use

Do not use this skill as the primary guide for:

• CEL program development (cel-programs) -- CEL program structure, state model, and mito workflow. Exception: the auth.aws / use_cloud_connectors template block for Federated Identity is owned here via references/federated-identity-aws.md
• ingest pipeline processor design (ingest-pipelines)
• field mappings and ECS compliance (ecs-field-mappings)
• var_groups / provider_permissions schema and format_version floors alone (package-spec) -- use this skill for the end-to-end federation procedure that applies them

Mandatory first read

Always load `references/common-input-patterns.md` first. It covers patterns that apply to every input type (tags, processors passthrough, variable conventions, forwarded/publisher_pipeline.disable_host coupling). These patterns are prerequisites for all type-specific guides.

Type routing table

Detect the input type from the filename pattern in agent/stream/ or from the data stream manifest input: field, then load the matching guide.

Load only the guide for the detected input type, not all guides.

For Federated Identity tasks (any eligible input type, including cel), load references/federated-identity-aws.md regardless of which input type is involved.

Handoff

• For CEL program logic, hand off to the cel-programs skill. Keep this skill loaded for Federated Identity auth.aws / use_cloud_connectors edits on cel.yml.hbs.
• For manifest schema (var_groups, provider_permissions, format_version / conditions floors), hand off to the package-spec skill (references/var-groups-and-provider-permissions.md).
• For pipeline issues discovered while reviewing input templates, hand off to the ingest-pipelines skill.
• For field mapping issues found in template variable wiring, hand off to the ecs-field-mappings skill.

References

• references/common-input-patterns.md -- tags, processors passthrough, variable conventions, review flags (applies to ALL input types)
• references/httpjson-guide.md -- HTTPJSON template syntax, structure, validation rules, pagination patterns, authentication, cursor persistence
• references/aws-s3-guide.md -- S3 bucket/SQS notification collection
• references/aws-cloudwatch-guide.md -- CloudWatch log group collection
• references/azure-blob-storage-guide.md -- Azure Blob Storage collection
• references/azure-eventhub-guide.md -- Azure Event Hub collection
• references/gcs-guide.md -- Google Cloud Storage collection
• references/gcp-pubsub-guide.md -- GCP Pub/Sub collection
• references/tcp-udp-guide.md -- TCP and UDP (syslog-style) listeners
• references/http-endpoint-guide.md -- HTTP Endpoint (webhook receiver)
• references/filestream-logfile-guide.md -- Filestream and legacy Logfile inputs
• references/journald-guide.md -- Journald collection
• references/winlog-guide.md -- Windows Event Log collection
• references/websocket-guide.md -- WebSocket streaming (may embed CEL)
• references/federated-identity-aws.md -- AWS Federated Identity procedure: input classification, federation vars, auth.aws / use_cloud_connectors, input gating (schema lives in package-spec)