variable "exclusion_filters" {
  type = list(object({
    name        = string
    query       = string
    is_enabled  = optional(bool, true)
    sample_rate = optional(number, 1.0)
  }))
  default = [
    {
      name  = "QA neo4j batch ingest"
      query = "index:main service:neo4j host:qa* \"execute in batch no\""
    },
    {
      name  = "exclude health checks"
      query = "\"GET /hello*\""
    },
    {
      name  = "exclude monolith health checks"
      query = "\"GET /healthchk.php\""
    },
    {
      name  = "Exclude VPC flow logs"
      query = "source:vpc"
    },
    {
      name  = "Exclude ECS Agent info logs"
      query = "source:ecs-agent sourcecategory:agent @level:info"
    },
    {
      name  = "Exclude Allowed WAF Actions"
      query = "service:waf @system.action:ALLOW"
    },
    {
      name  = "Lambda START/END logs"
      query = "source:lambda (message:(\"START RequestId:*\" OR \"END RequestId:*\"))"
    },
    {
      name  = "dockerd-configured_log_driver_filter"
      query = "source:dockerd \"Configured log driver does not support reads\""
    },
    {
      name  = "VECTOR Debug Filter"
      query = "service:vector* (\"No messages left in all queues\" OR \"Obtaining Queue URL\" OR \"Checking queues for\" OR \"Uploading file\" OR \"Transporter created\" OR \"Secrets manager\" OR \"Calling ows-assets\" OR \"Copying hydrated config files from S3\" OR \"Getting Track info.\" OR \"Received Track info.\" OR \"Setting task protection\" OR \"Successfully set task protection\" OR \"Delivery succeeded.\" OR \"Delivery attempt #\" OR \"Start transferring.\" OR \"Transfer command successful.\" OR \"initialize S3Connection for phy loc\" OR \"Login to the transporter.\" OR \"SFTP connection successful\" OR \"Getting DD location.\" OR \"Start transfering.\" OR \"Connect to the transporter.\" OR \"Creating transporter.\" OR \"Conn obj created for s3.\" OR \"Creating conn obj.\" OR \"Done parsing remote filename\" OR \"sent delivery delivery.job_attempt metric for job ID\" OR \"sent encoding encoding.job_success metric for job ID\" OR \"Conn obj created for sftp.\" OR \"Starting the transport process\" OR \"Removing /var/app/\" OR \"Getting contents of /var/app/\" OR \"Local file: /var/app/direct_delivery/\" OR \"Remote file:\" OR \"Transferring /var/app/direct_delivery/\" OR (\"Transferring /var/app/direct_delivery/\" AND \"succeeded.\") OR \"Deleting files with prefix\" OR \"Deleting dir\" OR \"Queue size of\" OR \"Starting worker at deliver_tracks.php worker timeout is set to 24h\" OR \"sent encoding encoding.job_attempt metric for job ID\" OR \"sent encoding encoding.worker_start metric for job ID\" OR \"No message found from queue\" OR \"Removing job from queue\" OR \"sent encoding\" OR \"sent delivery\" OR \"Getting Metadata\" OR \"Saving Metadata\" OR \"Reading messages from\" OR \"Setting encoding specs\" OR \"script_type encoding_tracks seek_time\" OR \"script_type deliver_tracks seek_time\" OR \"Setting configurations\" OR \"Processing non-stored format\" OR \"Encoding Audio\" OR \"Encoding Image\" OR \"Checking stored file for format\" OR \"Removing local Dir:\" OR \"Writing knownHosts File:\" OR \"DELIVERY_INITIAL_DIR set:\" OR \"Failed to get ows-product-store-mapping:\" OR \"Transporter disk usage\")"
    },
    {
      name  = "Exclude cloudfront log file headers"
      query = "source:cloudfront (\"#Fields: date time x-edge-location sc-bytes c-ip cs-method cs(Host) cs-uri-stem sc-status cs(Referer) cs(User-Agent) cs-uri-query cs(Cookie) x-edge-result-type x-edge-request-id x-host-header cs-protocol cs-bytes time-taken x-forwarded-for ssl-protocol ssl-cipher x-edge-response-result-type cs-protocol-version fle-status fle-encrypted-fields c-port time-to-first-byte x-edge-detailed-result-type sc-content-type sc-content-len sc-range-start sc-range-end\" OR \"#Version: 1.0\")"
    },
    {
      name  = "Flask request autologs for 200s"
      query = "service:ows* ^200 @logger.method_name:autolog"
    },
    {
      name  = "ioc-block-list - exclude elb healthchecks and localhost requests"
      query = "service:*ioc-block-list (@network.client.ip:127.0.0.1 OR @http.useragent:ELB-HealthChecker*)"
    },
    {
      name  = "lambda-sr-record-event Run Reports"
      query = "source:lambda service:lambda-sr-record-event (message:\"REPORT \")"
    },
    {
      name  = "ows-carveouts filter"
      query = "service_name:ows-carveouts AND (\"Matched route\" OR \"Received Correlation-Id\")"
    },
    {
      name  = "prod-ows-product-staging /bulk-session/products/dataloader"
      query = "source:prod-ows-product-staging AND \"POST /bulk-session/products/dataloader\""
    },
    {
      name  = "Exclude fluentbit logs"
      query = "source:aws-for-fluent-bit"
    },
    {
      name  = "Exclude Fansifter Cloudfront Logs"
      query = "source:s3 (@distribution:d278g4z5xlk3k1.cloudfront.net OR @distribution:djzajjy4mfvk4.cloudfront.net OR @distribution:dg5zvwah14040.cloudfront.net OR @distrbution:d36eqw7hzu2tf7.cloudfront.net)"
    },
    {
      name  = "exclude gtm-tiktok elb ok"
      query = "source:elb service_name:gtm-tiktok status:ok"
    },
    {
      name  = "exclude datadoglambdafunction"
      query = "source:lambda functionname:datadoglambdafunction"
    },
    {
      name  = "exclude spring boot health checks"
      query = "actuator/health"
    },
    {
      name  = "exclude generic LB health checks"
      query = "\"GET /health\""
    },
  ]
}