diff --git a/.idea/workspace.xml b/.idea/workspace.xml
index 7b63234..eb8e3d8 100644
--- a/.idea/workspace.xml
+++ b/.idea/workspace.xml
@@ -1,9 +1,13 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <project version="4">
   <component name="ChangeListManager">
-    <list default="true" id="5d2eb73b-b080-4040-becf-dac45602ac01" name="Default Changelist" comment="">
+    <list default="true" id="5d2eb73b-b080-4040-becf-dac45602ac01" name="Default Changelist" comment="Correct healthcheck">
       <change beforePath="$PROJECT_DIR$/.idea/workspace.xml" beforeDir="false" afterPath="$PROJECT_DIR$/.idea/workspace.xml" afterDir="false" />
       <change beforePath="$PROJECT_DIR$/docker-compose.yml" beforeDir="false" afterPath="$PROJECT_DIR$/docker-compose.yml" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/package/etc/conf.d/splunk.conf" beforeDir="false" afterPath="$PROJECT_DIR$/package/etc/conf.d/splunk.conf" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/tests/Dockerfile" beforeDir="false" afterPath="$PROJECT_DIR$/tests/Dockerfile" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/tests/requirements.txt" beforeDir="false" afterPath="$PROJECT_DIR$/tests/requirements.txt" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/tests/test_poc.py" beforeDir="false" afterPath="$PROJECT_DIR$/tests/test_poc.py" afterDir="false" />
     </list>
     <option name="EXCLUDED_CONVERTED_TO_IGNORED" value="true" />
     <option name="SHOW_DIALOG" value="false" />
@@ -13,77 +17,41 @@
   </component>
   <component name="FileEditorManager">
     <leaf SIDE_TABS_SIZE_LIMIT_KEY="300">
-      <file pinned="false" current-in-tab="false">
-        <entry file="file://$PROJECT_DIR$/package/Dockerfile">
-          <provider selected="true" editor-type-id="text-editor">
-            <state relative-caret-position="166">
-              <caret line="72" selection-start-line="72" selection-end-line="72" />
-            </state>
-          </provider>
-        </entry>
-      </file>
-      <file pinned="false" current-in-tab="false">
-        <entry file="file://$PROJECT_DIR$/package/scripts/switch_transport.sh">
+      <file pinned="false" current-in-tab="true">
+        <entry file="file://$PROJECT_DIR$/tests/test_poc.py">
           <provider selected="true" editor-type-id="text-editor">
-            <state relative-caret-position="133">
-              <caret line="7" column="27" selection-start-line="7" selection-start-column="5" selection-end-line="7" selection-end-column="27" />
+            <state relative-caret-position="657">
+              <caret line="57" selection-start-line="57" selection-end-line="57" />
+              <folding>
+                <element signature="e#0#30#0" expanded="true" />
+              </folding>
             </state>
           </provider>
         </entry>
       </file>
       <file pinned="false" current-in-tab="false">
-        <entry file="file://$PROJECT_DIR$/package/sbin/entrypoint.sh">
+        <entry file="file://$USER_HOME$/Library/Caches/PyCharm2019.1/remote_sources/-1691740145/1170049292/_pytest/python.py">
           <provider selected="true" editor-type-id="text-editor">
-            <state relative-caret-position="152">
-              <caret line="8" lean-forward="true" selection-start-line="8" selection-end-line="8" />
+            <state relative-caret-position="-462">
+              <caret line="173" selection-start-line="173" selection-end-line="173" />
             </state>
           </provider>
         </entry>
       </file>
       <file pinned="false" current-in-tab="false">
-        <entry file="file://$PROJECT_DIR$/package/etc/syslog-ng.conf">
-          <provider selected="true" editor-type-id="text-editor">
-            <state relative-caret-position="147">
-              <caret line="23" column="23" selection-start-line="23" selection-start-column="23" selection-end-line="23" selection-end-column="23" />
-            </state>
-          </provider>
-        </entry>
-      </file>
-      <file pinned="false" current-in-tab="true">
         <entry file="file://$PROJECT_DIR$/docker-compose.yml">
           <provider selected="true" editor-type-id="text-editor">
-            <state relative-caret-position="-524">
-              <caret line="9" column="18" selection-start-line="9" selection-start-column="18" selection-end-line="9" selection-end-column="18" />
+            <state relative-caret-position="649">
+              <caret line="44" column="24" selection-start-line="44" selection-start-column="24" selection-end-line="44" selection-end-column="34" />
             </state>
           </provider>
         </entry>
       </file>
       <file pinned="false" current-in-tab="false">
-        <entry file="file://$PROJECT_DIR$/README.md">
-          <provider selected="true" editor-type-id="split-provider[text-editor;markdown-preview-editor]">
-            <state split_layout="SPLIT">
-              <first_editor relative-caret-position="38">
-                <caret line="2" selection-start-line="2" selection-end-line="2" />
-              </first_editor>
-              <second_editor />
-            </state>
-          </provider>
-        </entry>
-      </file>
-      <file pinned="false" current-in-tab="false">
-        <entry file="file://$PROJECT_DIR$/package/goss.yml">
-          <provider selected="true" editor-type-id="text-editor">
-            <state relative-caret-position="285">
-              <caret line="15" column="13" selection-start-line="15" selection-start-column="13" selection-end-line="15" selection-end-column="13" />
-            </state>
-          </provider>
-        </entry>
-      </file>
-      <file pinned="false" current-in-tab="false">
-        <entry file="file://$PROJECT_DIR$/package/etc/conf.d/splunk.conf">
+        <entry file="file://$PROJECT_DIR$/tests/requirements.txt">
           <provider selected="true" editor-type-id="text-editor">
-            <state relative-caret-position="184">
-              <caret line="23" column="26" selection-start-line="23" selection-start-column="26" selection-end-line="23" selection-end-column="26" />
+            <state relative-caret-position="57">
+              <caret line="3" column="37" selection-start-line="3" selection-start-column="37" selection-end-line="3" selection-end-column="37" />
             </state>
           </provider>
         </entry>
@@ -111,19 +79,20 @@
     <option name="CHANGED_PATHS">
       <list>
         <option value="$PROJECT_DIR$/requirements.txt" />
-        <option value="$PROJECT_DIR$/tests/test_poc.py" />
         <option value="$PROJECT_DIR$/.pytest_cache/Dockerfile" />
         <option value="$PROJECT_DIR$/Dockerfile" />
-        <option value="$PROJECT_DIR$/tests/Dockerfile" />
         <option value="$PROJECT_DIR$/package/confluent.repo" />
         <option value="$PROJECT_DIR$/package/etc/conf.d/sources/s_defaults.conf" />
         <option value="$PROJECT_DIR$/README.md" />
-        <option value="$PROJECT_DIR$/package/goss.yml" />
         <option value="$PROJECT_DIR$/package/sbin/entrypoint.sh" />
-        <option value="$PROJECT_DIR$/package/etc/conf.d/splunk.conf" />
-        <option value="$PROJECT_DIR$/package/Dockerfile" />
         <option value="$PROJECT_DIR$/package/etc/syslog-ng.conf" />
+        <option value="$PROJECT_DIR$/package/Dockerfile" />
+        <option value="$PROJECT_DIR$/package/goss.yml" />
+        <option value="$PROJECT_DIR$/tests/Dockerfile" />
+        <option value="$PROJECT_DIR$/package/etc/conf.d/splunk.conf" />
         <option value="$PROJECT_DIR$/docker-compose.yml" />
+        <option value="$PROJECT_DIR$/tests/requirements.txt" />
+        <option value="$PROJECT_DIR$/tests/test_poc.py" />
       </list>
     </option>
   </component>
@@ -145,6 +114,38 @@
               <item name="sc4s" type="b2602c69:ProjectViewProjectNode" />
               <item name="sc4s" type="462c0819:PsiDirectoryNode" />
             </path>
+            <path>
+              <item name="sc4s" type="b2602c69:ProjectViewProjectNode" />
+              <item name="sc4s" type="462c0819:PsiDirectoryNode" />
+              <item name="package" type="462c0819:PsiDirectoryNode" />
+            </path>
+            <path>
+              <item name="sc4s" type="b2602c69:ProjectViewProjectNode" />
+              <item name="sc4s" type="462c0819:PsiDirectoryNode" />
+              <item name="package" type="462c0819:PsiDirectoryNode" />
+              <item name="etc" type="462c0819:PsiDirectoryNode" />
+            </path>
+            <path>
+              <item name="sc4s" type="b2602c69:ProjectViewProjectNode" />
+              <item name="sc4s" type="462c0819:PsiDirectoryNode" />
+              <item name="package" type="462c0819:PsiDirectoryNode" />
+              <item name="etc" type="462c0819:PsiDirectoryNode" />
+              <item name="conf.d" type="462c0819:PsiDirectoryNode" />
+            </path>
+            <path>
+              <item name="sc4s" type="b2602c69:ProjectViewProjectNode" />
+              <item name="sc4s" type="462c0819:PsiDirectoryNode" />
+              <item name="package" type="462c0819:PsiDirectoryNode" />
+              <item name="etc" type="462c0819:PsiDirectoryNode" />
+              <item name="conf.d" type="462c0819:PsiDirectoryNode" />
+              <item name="blocks" type="462c0819:PsiDirectoryNode" />
+            </path>
+            <path>
+              <item name="sc4s" type="b2602c69:ProjectViewProjectNode" />
+              <item name="sc4s" type="462c0819:PsiDirectoryNode" />
+              <item name="package" type="462c0819:PsiDirectoryNode" />
+              <item name="scripts" type="462c0819:PsiDirectoryNode" />
+            </path>
             <path>
               <item name="sc4s" type="b2602c69:ProjectViewProjectNode" />
               <item name="sc4s" type="462c0819:PsiDirectoryNode" />
@@ -252,7 +253,7 @@
       <workItem from="1561601137668" duration="2116000" />
       <workItem from="1561639548755" duration="1822000" />
       <workItem from="1561641521581" duration="41606000" />
-      <workItem from="1561723177513" duration="3849000" />
+      <workItem from="1561723177513" duration="12835000" />
     </task>
     <task id="LOCAL-00001" summary="Clean build of syslog-docker">
       <created>1561725354114</created>
@@ -268,65 +269,87 @@
       <option name="project" value="LOCAL" />
       <updated>1561727911945</updated>
     </task>
-    <option name="localTasksCounter" value="3" />
+    <task id="LOCAL-00003" summary="compose with proper service names">
+      <created>1561728088283</created>
+      <option name="number" value="00003" />
+      <option name="presentableId" value="LOCAL-00003" />
+      <option name="project" value="LOCAL" />
+      <updated>1561728088283</updated>
+    </task>
+    <task id="LOCAL-00004" summary="Correct healthcheck">
+      <created>1561732858768</created>
+      <option name="number" value="00004" />
+      <option name="presentableId" value="LOCAL-00004" />
+      <option name="project" value="LOCAL" />
+      <updated>1561732858768</updated>
+    </task>
+    <option name="localTasksCounter" value="5" />
     <servers />
   </component>
   <component name="TestHistory">
-    <history-entry file="pytest_in_tests_docker - 2019.06.27 at 08h 46m 56s.xml">
+    <history-entry file="pytest_in_tests_docker - 2019.06.28 at 13h 04m 13s.xml">
       <configuration name="pytest in tests docker" configurationId="tests" />
     </history-entry>
-    <history-entry file="pytest_in_tests_docker - 2019.06.27 at 08h 47m 24s.xml">
+    <history-entry file="pytest_in_tests_docker - 2019.06.28 at 13h 04m 24s.xml">
       <configuration name="pytest in tests docker" configurationId="tests" />
     </history-entry>
-    <history-entry file="pytest_in_tests_docker - 2019.06.27 at 08h 51m 27s.xml">
+    <history-entry file="pytest_in_tests_docker - 2019.06.28 at 13h 04m 49s.xml">
       <configuration name="pytest in tests docker" configurationId="tests" />
     </history-entry>
-    <history-entry file="pytest_in_tests_docker - 2019.06.27 at 09h 04m 15s.xml">
+    <history-entry file="pytest_in_tests_docker - 2019.06.28 at 13h 09m 25s.xml">
       <configuration name="pytest in tests docker" configurationId="tests" />
     </history-entry>
-    <history-entry file="pytest_in_tests_docker - 2019.06.27 at 09h 24m 55s.xml">
+    <history-entry file="pytest_in_tests_docker - 2019.06.28 at 13h 09m 49s.xml">
       <configuration name="pytest in tests docker" configurationId="tests" />
     </history-entry>
-    <history-entry file="pytest_in_tests_docker - 2019.06.27 at 09h 32m 53s.xml">
+    <history-entry file="pytest_in_tests_docker - 2019.06.28 at 13h 15m 10s.xml">
       <configuration name="pytest in tests docker" configurationId="tests" />
     </history-entry>
-    <history-entry file="pytest_in_tests_docker - 2019.06.27 at 09h 34m 20s.xml">
+    <history-entry file="pytest_in_tests_docker - 2019.06.28 at 13h 19m 05s.xml">
       <configuration name="pytest in tests docker" configurationId="tests" />
     </history-entry>
-    <history-entry file="pytest_in_tests_docker - 2019.06.27 at 09h 35m 43s.xml">
+    <history-entry file="pytest_in_tests_docker - 2019.06.28 at 13h 19m 18s.xml">
       <configuration name="pytest in tests docker" configurationId="tests" />
     </history-entry>
-    <history-entry file="pytest_in_tests_docker - 2019.06.27 at 09h 50m 52s.xml">
+    <history-entry file="pytest_in_tests_docker - 2019.06.28 at 13h 20m 41s.xml">
       <configuration name="pytest in tests docker" configurationId="tests" />
     </history-entry>
-    <history-entry file="pytest_in_tests_docker - 2019.06.27 at 09h 51m 50s.xml">
+    <history-entry file="pytest_in_tests_docker - 2019.06.28 at 13h 21m 44s.xml">
       <configuration name="pytest in tests docker" configurationId="tests" />
     </history-entry>
   </component>
   <component name="TimeTrackingManager">
-    <option name="totallyTimeSpent" value="49393000" />
+    <option name="totallyTimeSpent" value="58379000" />
+  </component>
+  <component name="TodoView">
+    <todo-panel id="selected-file">
+      <is-autoscroll-to-source value="true" />
+    </todo-panel>
+    <todo-panel id="all">
+      <are-packages-shown value="true" />
+      <is-autoscroll-to-source value="true" />
+    </todo-panel>
   </component>
   <component name="ToolWindowManager">
     <frame x="0" y="165" width="1760" height="825" extended-state="0" />
-    <editor active="true" />
     <layout>
-      <window_info active="true" content_ui="combo" id="Project" order="0" visible="true" weight="0.2048894" />
+      <window_info content_ui="combo" id="Project" order="0" visible="true" weight="0.2048894" />
       <window_info id="Structure" order="1" side_tool="true" weight="0.25" />
       <window_info id="Favorites" order="2" side_tool="true" />
       <window_info anchor="bottom" id="Messages" />
       <window_info anchor="bottom" id="Message" order="0" />
       <window_info anchor="bottom" id="Find" order="1" />
-      <window_info anchor="bottom" id="Run" order="2" sideWeight="0.49650756" weight="0.46793997" />
-      <window_info anchor="bottom" id="Debug" order="3" weight="0.4" />
+      <window_info anchor="bottom" id="Run" order="2" sideWeight="0.49534342" weight="0.46793997" />
+      <window_info active="true" anchor="bottom" id="Debug" order="3" visible="true" weight="0.39972714" />
       <window_info anchor="bottom" id="Cvs" order="4" weight="0.25" />
       <window_info anchor="bottom" id="Inspection" order="5" weight="0.4" />
-      <window_info anchor="bottom" id="TODO" order="6" />
-      <window_info anchor="bottom" id="Docker" order="7" weight="0.32963988" />
-      <window_info anchor="bottom" id="Version Control" order="8" visible="true" weight="0.3287858" />
+      <window_info anchor="bottom" id="TODO" order="6" weight="0.3287858" />
+      <window_info anchor="bottom" id="Docker" order="7" weight="0.3287858" />
+      <window_info anchor="bottom" id="Version Control" order="8" sideWeight="0.49941793" weight="0.3287858" />
       <window_info anchor="bottom" id="Database Changes" order="9" />
-      <window_info anchor="bottom" id="Event Log" order="10" sideWeight="0.5040745" side_tool="true" weight="0.5770805" />
-      <window_info anchor="bottom" id="Terminal" order="11" sideWeight="0.4959255" weight="0.35470667" />
-      <window_info anchor="bottom" id="Python Console" order="12" />
+      <window_info anchor="bottom" id="Event Log" order="10" sideWeight="0.50465655" side_tool="true" weight="0.46793997" />
+      <window_info anchor="bottom" id="Terminal" order="11" sideWeight="0.49476135" weight="0.48294678" />
+      <window_info anchor="bottom" id="Python Console" order="12" sideWeight="0.49767172" weight="0.3287858" />
       <window_info anchor="right" id="Commander" internal_type="SLIDING" order="0" type="SLIDING" weight="0.4" />
       <window_info anchor="right" id="Ant Build" order="1" weight="0.25" />
       <window_info anchor="right" content_ui="combo" id="Hierarchy" order="2" weight="0.25" />
@@ -340,11 +363,29 @@
   <component name="VcsManagerConfiguration">
     <MESSAGE value="Clean build of syslog-docker" />
     <MESSAGE value="Build with healthcheck" />
-    <option name="LAST_COMMIT_MESSAGE" value="Build with healthcheck" />
+    <MESSAGE value="compose with proper service names" />
+    <MESSAGE value="Correct healthcheck" />
+    <option name="LAST_COMMIT_MESSAGE" value="Correct healthcheck" />
+  </component>
+  <component name="XDebuggerManager">
+    <breakpoint-manager>
+      <breakpoints>
+        <line-breakpoint enabled="true" suspend="THREAD" type="python-line">
+          <url>file://$PROJECT_DIR$/tests/test_poc.py</url>
+          <line>78</line>
+          <option name="timeStamp" value="3" />
+        </line-breakpoint>
+        <line-breakpoint enabled="true" suspend="THREAD" type="python-line">
+          <url>file://$PROJECT_DIR$/tests/test_poc.py</url>
+          <line>57</line>
+          <option name="timeStamp" value="6" />
+        </line-breakpoint>
+      </breakpoints>
+    </breakpoint-manager>
   </component>
   <component name="com.intellij.coverage.CoverageDataManagerImpl">
     <SUITE FILE_PATH="coverage/sc4s$pytest_in_tests.coverage" NAME="pytest in tests Coverage Results" MODIFIED="1561601401665" SOURCE_PROVIDER="com.intellij.coverage.DefaultCoverageFileProvider" RUNNER="coverage.py" COVERAGE_BY_TEST_ENABLED="true" COVERAGE_TRACING_ENABLED="false" WORKING_DIRECTORY="" />
-    <SUITE FILE_PATH="coverage/sc4s$pytest_in_tests_docker.coverage" NAME="pytest in tests docker Coverage Results" MODIFIED="1561643507763" SOURCE_PROVIDER="com.intellij.coverage.DefaultCoverageFileProvider" RUNNER="coverage.py" COVERAGE_BY_TEST_ENABLED="true" COVERAGE_TRACING_ENABLED="false" WORKING_DIRECTORY="" />
+    <SUITE FILE_PATH="coverage/sc4s$pytest_in_tests_docker.coverage" NAME="pytest in tests docker Coverage Results" MODIFIED="1561742779121" SOURCE_PROVIDER="com.intellij.coverage.DefaultCoverageFileProvider" RUNNER="coverage.py" COVERAGE_BY_TEST_ENABLED="true" COVERAGE_TRACING_ENABLED="false" WORKING_DIRECTORY="" />
   </component>
   <component name="editorHistoryManager">
     <entry file="file://$PROJECT_DIR$/package/confluent.repo">
@@ -361,25 +402,25 @@
         </state>
       </provider>
     </entry>
-    <entry file="file://$PROJECT_DIR$/tests/Dockerfile">
+    <entry file="file://$PROJECT_DIR$/package/etc/conf.d/sources/s_defaults.conf" />
+    <entry file="file://$PROJECT_DIR$/package/sbin/entrypoint.sh">
       <provider selected="true" editor-type-id="text-editor">
-        <state relative-caret-position="133">
-          <caret line="7" lean-forward="true" selection-start-line="7" selection-end-line="7" />
+        <state relative-caret-position="152">
+          <caret line="8" lean-forward="true" selection-start-line="8" selection-end-line="8" />
         </state>
       </provider>
     </entry>
-    <entry file="file://$PROJECT_DIR$/tests/test_poc.py">
+    <entry file="file://$PROJECT_DIR$/package/Dockerfile">
       <provider selected="true" editor-type-id="text-editor">
-        <state relative-caret-position="152">
-          <caret line="8" selection-start-line="8" selection-end-line="8" />
+        <state relative-caret-position="353">
+          <caret line="89" column="8" selection-start-line="89" selection-start-column="8" selection-end-line="89" selection-end-column="8" />
         </state>
       </provider>
     </entry>
-    <entry file="file://$PROJECT_DIR$/package/etc/conf.d/sources/s_defaults.conf" />
-    <entry file="file://$PROJECT_DIR$/tests/requirements.txt">
+    <entry file="file://$PROJECT_DIR$/package/etc/syslog-ng.conf">
       <provider selected="true" editor-type-id="text-editor">
-        <state>
-          <caret column="6" selection-start-column="6" selection-end-column="6" />
+        <state relative-caret-position="437">
+          <caret line="23" column="23" selection-start-line="23" selection-start-column="23" selection-end-line="23" selection-end-column="23" />
         </state>
       </provider>
     </entry>
@@ -395,50 +436,105 @@
     </entry>
     <entry file="file://$PROJECT_DIR$/package/goss.yml">
       <provider selected="true" editor-type-id="text-editor">
-        <state relative-caret-position="285">
-          <caret line="15" column="13" selection-start-line="15" selection-start-column="13" selection-end-line="15" selection-end-column="13" />
+        <state relative-caret-position="209">
+          <caret line="11" column="13" selection-start-line="11" selection-start-column="13" selection-end-line="11" selection-end-column="13" />
         </state>
       </provider>
     </entry>
-    <entry file="file://$PROJECT_DIR$/package/sbin/entrypoint.sh">
+    <entry file="file://$PROJECT_DIR$/tests/Dockerfile">
       <provider selected="true" editor-type-id="text-editor">
-        <state relative-caret-position="152">
-          <caret line="8" lean-forward="true" selection-start-line="8" selection-end-line="8" />
+        <state relative-caret-position="114">
+          <caret line="6" column="17" selection-start-line="6" selection-start-column="17" selection-end-line="6" selection-end-column="17" />
         </state>
       </provider>
     </entry>
-    <entry file="file://$PROJECT_DIR$/package/scripts/switch_transport.sh">
+    <entry file="file://$PROJECT_DIR$/package/scripts/splunkmetrics.sh">
       <provider selected="true" editor-type-id="text-editor">
-        <state relative-caret-position="133">
-          <caret line="7" column="27" selection-start-line="7" selection-start-column="5" selection-end-line="7" selection-end-column="27" />
+        <state relative-caret-position="90">
+          <caret line="16" column="38" selection-start-line="16" selection-start-column="17" selection-end-line="16" selection-end-column="38" />
         </state>
       </provider>
     </entry>
+    <entry file="file://$PROJECT_DIR$/package/etc/conf.d/templates/t_templates.conf">
+      <provider selected="true" editor-type-id="text-editor" />
+    </entry>
+    <entry file="file://$PROJECT_DIR$/package/etc/conf.d/blocks/b_parsers.conf">
+      <provider selected="true" editor-type-id="text-editor">
+        <state relative-caret-position="-124">
+          <caret line="6" column="536" selection-start-line="6" selection-start-column="2" selection-end-line="6" selection-end-column="536" />
+        </state>
+      </provider>
+    </entry>
+    <entry file="file://$PROJECT_DIR$/package/etc/conf.d/filters/f_filter.spec">
+      <provider selected="true" editor-type-id="text-editor">
+        <state relative-caret-position="-3056" />
+      </provider>
+    </entry>
+    <entry file="file://$PROJECT_DIR$/package/etc/conf.d/filters/f_websense.conf">
+      <provider selected="true" editor-type-id="text-editor" />
+    </entry>
+    <entry file="file://$PROJECT_DIR$/package/etc/conf.d/filters/f_palo_alto.conf">
+      <provider selected="true" editor-type-id="text-editor">
+        <state relative-caret-position="-947" />
+      </provider>
+    </entry>
+    <entry file="file://$PROJECT_DIR$/package/etc/conf.d/filters/f_cisco-ios.conf">
+      <provider selected="true" editor-type-id="text-editor">
+        <state relative-caret-position="-890" />
+      </provider>
+    </entry>
+    <entry file="file://$PROJECT_DIR$/package/etc/conf.d/filters/f_catchall.conf">
+      <provider selected="true" editor-type-id="text-editor">
+        <state relative-caret-position="-526" />
+      </provider>
+    </entry>
+    <entry file="file://$PROJECT_DIR$/package/etc/conf.d/blocks/b_destinations.conf">
+      <provider selected="true" editor-type-id="text-editor">
+        <state relative-caret-position="-536" />
+      </provider>
+    </entry>
     <entry file="file://$PROJECT_DIR$/package/etc/conf.d/splunk.conf">
       <provider selected="true" editor-type-id="text-editor">
-        <state relative-caret-position="184">
-          <caret line="23" column="26" selection-start-line="23" selection-start-column="26" selection-end-line="23" selection-end-column="26" />
+        <state relative-caret-position="157">
+          <caret line="35" column="23" selection-start-line="35" selection-start-column="23" selection-end-line="35" selection-end-column="23" />
         </state>
       </provider>
     </entry>
-    <entry file="file://$PROJECT_DIR$/package/Dockerfile">
+    <entry file="file://$PROJECT_DIR$/package/scripts/switch_transport.sh">
       <provider selected="true" editor-type-id="text-editor">
-        <state relative-caret-position="166">
-          <caret line="72" selection-start-line="72" selection-end-line="72" />
+        <state relative-caret-position="100">
+          <caret line="14" column="33" selection-start-line="14" selection-start-column="13" selection-end-line="14" selection-end-column="33" />
         </state>
       </provider>
     </entry>
-    <entry file="file://$PROJECT_DIR$/package/etc/syslog-ng.conf">
+    <entry file="file://$PROJECT_DIR$/tests/requirements.txt">
       <provider selected="true" editor-type-id="text-editor">
-        <state relative-caret-position="147">
-          <caret line="23" column="23" selection-start-line="23" selection-start-column="23" selection-end-line="23" selection-end-column="23" />
+        <state relative-caret-position="57">
+          <caret line="3" column="37" selection-start-line="3" selection-start-column="37" selection-end-line="3" selection-end-column="37" />
         </state>
       </provider>
     </entry>
     <entry file="file://$PROJECT_DIR$/docker-compose.yml">
       <provider selected="true" editor-type-id="text-editor">
-        <state relative-caret-position="-524">
-          <caret line="9" column="18" selection-start-line="9" selection-start-column="18" selection-end-line="9" selection-end-column="18" />
+        <state relative-caret-position="649">
+          <caret line="44" column="24" selection-start-line="44" selection-start-column="24" selection-end-line="44" selection-end-column="34" />
+        </state>
+      </provider>
+    </entry>
+    <entry file="file://$USER_HOME$/Library/Caches/PyCharm2019.1/remote_sources/-1691740145/1170049292/_pytest/python.py">
+      <provider selected="true" editor-type-id="text-editor">
+        <state relative-caret-position="-462">
+          <caret line="173" selection-start-line="173" selection-end-line="173" />
+        </state>
+      </provider>
+    </entry>
+    <entry file="file://$PROJECT_DIR$/tests/test_poc.py">
+      <provider selected="true" editor-type-id="text-editor">
+        <state relative-caret-position="657">
+          <caret line="57" selection-start-line="57" selection-end-line="57" />
+          <folding>
+            <element signature="e#0#30#0" expanded="true" />
+          </folding>
         </state>
       </provider>
     </entry>
diff --git a/docker-compose.yml b/docker-compose.yml
index 863039e..bacc2d6 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -4,6 +4,7 @@ services:
     build: ./tests
     links:
       - splunk
+      - sc4s
   sc4s:
     build: ./package
     hostname: sc4s
@@ -18,7 +19,7 @@ services:
     links:
       - splunk
     environment:
-      - SPLUNK_HEC_URL=https://splunk:8088/services/collector/event","https://splunk:8088/services/collector/event
+      - SPLUNK_HEC_URL=https://splunk:8088/services/collector/event
       - SPLUNK_HEC_STATSURL=https://splunk:8088/services/collector/event
       - SPLUNK_HEC_TOKEN=a778f63a-5dff-4e3c-a72c-a03183659e94
       - SPLUNK_CONNECT_METHOD=hec
diff --git a/package/etc/conf.d/splunk.conf b/package/etc/conf.d/splunk.conf
index 4ef03e6..e8e5306 100755
--- a/package/etc/conf.d/splunk.conf
+++ b/package/etc/conf.d/splunk.conf
@@ -33,8 +33,8 @@
 # ===============================================================================================
 # HEC transport
 # ===============================================================================================
-@define splunk-hec-url "http://127.0.0.1:9088/services/collector/event"
-@define splunk-hec-token "18f31be3-17e6-4e7b-88b0-4bdfbdb7ec88"
+@define splunk-hec-url __SPLUNK_HEC_URL__
+@define splunk-hec-token "__SPLUNK_HEC_TOKEN__"
 
 # ===============================================================================================
 # Splunk metadata (HEC/Kafka transport only)
diff --git a/tests/Dockerfile b/tests/Dockerfile
index 40f3552..695362a 100644
--- a/tests/Dockerfile
+++ b/tests/Dockerfile
@@ -4,4 +4,4 @@ COPY requirements.txt /
 
 RUN pip3 install -r /requirements.txt
 RUN mkdir /work
-CMD python --version
+CMD python pytest
diff --git a/tests/requirements.txt b/tests/requirements.txt
index 55b033e..f5e5e97 100644
--- a/tests/requirements.txt
+++ b/tests/requirements.txt
@@ -1 +1,4 @@
-pytest
\ No newline at end of file
+pytest
+jinja2
+jinja2-time
+http://dev.splunk.com/goto/sdk-python
diff --git a/tests/test_poc.py b/tests/test_poc.py
index 7dadfbc..b95ac2b 100644
--- a/tests/test_poc.py
+++ b/tests/test_poc.py
@@ -1,8 +1,79 @@
+from jinja2 import Environment
+import urllib.request
 
-def test_one():
+import random
 
-    assert 1 == 0
+import socket
 
-def test_two():
+import sys
+from time import sleep
+import splunklib.results as results
+import splunklib.client as client
+from time import sleep
 
-    assert 0 == 0
+
+
+env = Environment(extensions=['jinja2_time.TimeExtension'])
+word_url = "http://svnweb.freebsd.org/csrg/share/dict/words?view=co&content-type=text/plain"
+response = urllib.request.urlopen(word_url)
+long_txt = response.read().decode()
+words = long_txt.splitlines()
+
+def sendsingle(message):
+    # Create a TCP/IP socket
+    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+    server_address = ('sc4s', 514)
+
+    sock.connect(server_address)
+    sock.sendall(str.encode(message))
+
+def splunk_single(search):
+    service = client.connect(username="admin", password="Changed@11",host="splunk",port="8089")
+    kwargs_normalsearch = {"exec_mode": "normal"}
+    job = service.jobs.create(search, **kwargs_normalsearch)
+
+    # A normal search returns the job's SID right away, so we need to poll for completion
+    while True:
+        while not job.is_ready():
+            pass
+        stats = {"isDone": job["isDone"],
+                 "doneProgress": float(job["doneProgress"]) * 100,
+                 "scanCount": int(job["scanCount"]),
+                 "eventCount": int(job["eventCount"]),
+                 "resultCount": int(job["resultCount"])}
+
+        status = ("\r%(doneProgress)03.1f%%   %(scanCount)d scanned   "
+                  "%(eventCount)d matched   %(resultCount)d results") % stats
+
+        sys.stdout.write(status)
+        sys.stdout.flush()
+        if stats["isDone"] == "1":
+            sys.stdout.write("\n\nDone!\n\n")
+            break
+        sleep(2)
+
+    # Get the results and display them
+    resultCount=stats["resultCount"]
+    eventCount=stats["eventCount"]
+    return resultCount,eventCount
+
+
+
+def test_defaultroute():
+
+    ##mark## ##date##T##time##.000z "##name## bluecoat[0]:SPLV5
+
+    host = "{}-{}".format(random.choice(words),random.choice(words))
+
+
+    t = env.from_string("{{ mark }} {% now 'utc', '%b %d %H:%M:%S' %}.000z {{ host }} sc4s_default[0]: test")
+    message = t.render(mark="<111>1", host=host)
+
+    sendsingle(message)
+
+    sleep(15)
+
+    search = 'search "{}" | head 10'.format(host)
+
+    resultCount ,eventCount = splunk_single(search)
+    assert resultCount == 1