{% for extraction in SPLUNK_FIELD_EXTRACTIONS %}
{% if 'source' in extraction %}
[source::{{ extraction.source }}]
{% elif 'sourcetype' in extraction %}
[{{ extraction.sourcetype }}]
{% endif %}
{% if extraction.break_before is defined%}
BREAK_ONLY_BEFORE = {{ extraction.break_before }}
{% endif %}
{% if extraction.max_events is defined%}
MAX_EVENTS = {{ extraction.max_events }}
{% endif %}
{% if extraction.datetime_config is defined %}
DATETIME_CONFIG = {{ extraction.datetime_config }}
{% endif %}
{% if extraction.indexed_extractions is defined %}
INDEXED_EXTRACTIONS = {{ extraction.indexed_extractions }}
{% endif %}
{% if extraction.no_binary_check is defined %}
NO_BINARY_CHECK = {{ extraction.no_binary_check }}
{% endif %}
{% if extraction.timestamp_fields is defined %}
TIMESTAMP_FIELDS = {{ extraction.timestamp_fields }}
{% endif %}
{% if extraction.category is defined %}
category = {{ extraction.category }}
{% endif %}
{% if extraction.description is defined %}
description = {{ extraction.description }}
{% endif %}
{% if extraction.disabled is defined %}
disabled = {{ extraction.disabled }}
{% endif %}
{% if extraction.pulldown_type is defined %}
pulldown_type = {{ extraction.pulldown_type }}
{% endif %}
{% if extraction.name is defined %}
EXTRACT-{{ extraction.name }} = {{ extraction.regex }}
{% endif %}
{% if 'sourcetype' in extraction and extraction.sourcetype == "build_log" %}
EXTRACT-run-results = Setting status of .* and message: 'Build finished. (?P<num_run>\d+) tests run, (?P<num_skipped>\d+) skipped, (?P<num_failed>\d+) failed.
EXTRACT-error_msg = \n?ERROR: (?P<error_msg>[^\n]*)
EXTRACT-buildResult = Finished: (?P<buildResult>[A-Z]+)$
{% endif %}

{% endfor %}
