Thanks a lot Aaron. You're a god. 
Never tried receiving quality help this fast before. Only when posting here does this happen.
I managed to make this ingest pipeline in Elastic Dev Tools.
But apparently my team wants me to make it as a Logstash pipeline instead of Elastic.
Kind of makes me wonder why the syntax isn't identical for Logstash and Elastic pipelines. Seems kinda weird that they're part of the same stack, and to me seem like they serve an identical purpose, but have different syntax. Thats just some user feedback I guess.
Is there a Dev Tool like this for debugging and developing Logstash pipelines? Where I can get syntax help, and can see the results of the filters/mutations against a few test logs?
POST _ingest/pipeline/_simulate
{
"pipeline": {
"description": "IDM Server Access Logs",
"processors": [
{
"grok": {
"description": "Match Access Logs from IDM",
"field": "message",
"patterns": [
"[%{SYSLOGBASE:timestamptmp}]%{SPACE}conn=%{NUMBER:conn}%{SPACE}fd=%{NUMBER:fd}%{SPACE}slot=%{NUMBER:slot}%{SPACE}connection%{SPACE}from%{SPACE}%{IP:source.ip}%{SPACE}to%{SPACE}%{IP:destination.ip}",
"[%{SYSLOGBASE:timestamptmp}]%{SPACE}conn=%{NUMBER:conn}%{SPACE}op=%{NUMBER:op}%{SPACE}%{WORD:response}%{SPACE}%{GREEDYDATA:message}"
],
"pattern_definitions": {
"DIR_389_DATE": "%{MONTHDAY}/%{MONTH}/%{YEAR}:%{TIME}%{SPACE}%{INT}"
}
}
},
{
"convert": {
"field": "conn",
"type": "integer"
}
},
{
"convert": {
"if": "ctx?.response != null",
"field": "op",
"type": "integer"
}
},
{
"kv": {
"description": "Key=Value Filter",
"if": "ctx?.response == 'RESULT' || ctx?.response == 'BIND'",
"field": "message",
"field_split": " ",
"value_split": "="
}
},
{
"grok": {
"description": "Parsing SRCH",
"if": "ctx?.response == 'SRCH'",
"field": "message",
"patterns": [
"base=\"%{GREEDYDATA:search_base}\"%{SPACE}scope=%{NUMBER:scope}%{SPACE}filter=\"%{GREEDYDATA:filter}\"%{SPACE}attrs=\"%{GREEDYDATA:attrs}\""
]
}
}
]
},
"docs": [
{
"_source": {
"message": "[07/Oct/2021:11:42:16.992012759 +0000] conn=17 op=23 VLV 0:2147483647:A 0:0 (0)"
}
},
{
"_source": {
"message": "[07/Oct/2021:12:20:22.195029736 +0000] conn=65 op=0 BIND dn=\"\" method=sasl version=3 mech=GSS-SPNEGO"
}
},
{
"_source": {
"message": "[07/Oct/2021:12:20:21.389966613 +0000] conn=63 op=4 fd=100 closed - U1"
}
},
{
"_source": {
"message": "[07/Oct/2021:12:20:21.782680560 +0000] conn=64 fd=100 slot=100 connection from 192.168.32.31 to 192.168.32.31"
}
},
{
"_source": {
"message": "[07/Oct/2021:12:20:21.792684713 +0000] conn=64 op=4 UNBIND"
}
},
{
"_source": {
"message": "[07/Oct/2021:12:18:17.317416222 +0000] conn=62 op=8 RESULT err=0 tag=101 nentries=1 wtime=0.000091377 optime=0.000094949 etime=0.000185034"
}
},
{
"_source": {
"message": "[07/Oct/2021:12:20:21.378172479 +0000] conn=9 op=168 SRCH base=\"cn=ipaConfig,cn=etc,dc=vagrant,dc=dap,dc=cfcs,dc=dk\" scope=0 filter=\"(objectClass=*)\" attrs=\"ipaConfigString ipaKrbAuthzData ipaUserAuthType\""
}
},
{
"_source": {
"message": "[07/Oct/2021:12:20:21.383878855 +0000] conn=63 op=0 RESULT err=0 tag=97 nentries=0 wtime=0.000095614 optime=0.002627546 etime=0.002722173 dn=\"uid=admin,cn=users,cn=accounts,dc=vagrant,dc=dap,dc=cfcs,dc=dk\""
}
},
{
"_source": {
"message": "[07/Oct/2021:12:20:21.828424794 +0000] conn=8 op=218 SRCH base=\"dc=vagrant,dc=dap,dc=cfcs,dc=dk\" scope=2 filter=\"(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=admin@VAGRANT.DAP.CFCS.DK)(krbPrincipalName:caseIgnoreIA5Match:=admin@VAGRANT.DAP.CFCS.DK)))\" attrs=\"krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink objectClass\""
}
}
]
}