content: [sources.generate_syslog]
  type = "demo_logs"
  format = "syslog"
  interval = 0.01
  
  [transforms.remap_syslog]
  inputs = ["generate_syslog"]
  type = "remap"
  source = '''
    structured = parse_syslog!(.message)
  
    # Timestamp handling
    .timestamp = format_timestamp!(structured.timestamp, format: "%Y-%m-%d %H:%M:%S.%f")
  
    # Required fields from schema
    .trace_id = uuid_v4()
    .span_id = uuid_v4()
    .trace_flags = 0
    .service_name = structured.appname
    .namespace = "syslog"
    .body = structured.message
  
    # Map severity
    .severity_text = if includes(["emerg", "err", "crit", "alert"], structured.severity) {
      "ERROR"
    } else if structured.severity == "warning" {
      "WARN"
    } else if structured.severity == "debug" {
      "DEBUG"
    } else if includes(["info", "notice"], structured.severity) {
      "INFO"
    } else {
      structured.severity
    }
  
    # Convert severity to number
    .severity_number = if .severity_text == "ERROR" {
      17
    } else if .severity_text == "WARN" {
      13
    } else if .severity_text == "DEBUG" {
      5
    } else {
      9  # INFO
    }
  
    # Store syslog-specific fields in log_attributes
    .log_attributes = {
      "syslog.procid": structured.procid,
      "syslog.facility": structured.facility,
      "syslog.version": structured.version,
      "syslog.hostname": structured.hostname
    }
  
    # Cleanup
    del(.message)
    del(.source_type)
  '''
  
  [sinks.clickhouse]
  type = "clickhouse"
  inputs = ["remap_syslog"]
  endpoint = "http://localhost:8123"
  database = "default"
  table = "logs"
  # # auth.strategy = "basic"
  # # auth.user = "default"
  # # auth.password = ""
  
  # [sinks.console]
  # type = "console"
  # inputs = ["generate_syslog"]
  # encoding.codec = "json"
  