---
- name: test_trigger
  debug_level: 2
  distinguished_by:
  - instance_id
  - timestamp: "day"
  expiration: "$last + 1h"
  fire_pipeline: "test_pipeline"
  expire_pipeline: "test_expire_pipeline"
  match_criteria:
  - event_type:
    - compute.instance.*
    - "!compute.instance.exists"
#### Traits are optional. 
#    traits:
#      os_distro: ubuntu
#      memory_mb:
#        numeric: "> 4096"
  - event_type: compute.instance.exists
    map_distingushed_by:
      timestamp: audit_period_beginning
  fire_criteria:
  - event_type: compute.instance.exists