@leandrojmp here is the Ingest Pipeline:
{
"version": 1,
"processors": [
{
"set": {
"field": "event.ingested",
"value": "{{_ingest.timestamp}}"
}
},
{
"set": {
"field": "event.original",
"value": "{{_source.message}}",
"ignore_empty_value": true
}
},
{
"set": {
"field": "event.category",
"value": "process"
}
},
{
"set": {
"field": "event.dataset",
"value": "app.info"
}
},
{
"set": {
"field": "event.kind",
"value": "event"
}
},
{
"set": {
"field": "event.module",
"value": "app"
}
},
{
"set": {
"field": "event.type",
"value": "info"
}
},
{
"grok": {
"field": "message",
"patterns": [
"%{SYSLOGBASE} %{DATA:message}$",
"%{SYSLOGPROG} <%{NONNEGINT:facility}>%{INT} %{TIMESTAMP_ISO8601:timestamp} %{SYSLOGHOST:logsource} %{DATA:message}$"
],
"ignore_missing": true
}
},
{
"grok": {
"field": "message",
"patterns": [
"%{DATA:program} %{POSINT:pid} %{WORD:app} \\[%{DATA:kvp_1}\\]\\[%{DATA:kvp_2}\\] %{DATA:sub_message}$",
"%{USERNAME:program}\\(%{USERNAME:subprocess}:%{WORD:action}\\): %{DATA} %{USERNAME:user}$",
"%{USERNAME:program}\\(%{USERNAME:subprocess}:%{WORD:action}\\): %{DATA} %{USERNAME:user} %{DATA} \\(uid=%{INT:user_id}\\)$",
"%{DATA} %{IP:source.ip}$",
"%{USERNAME:username} : %{DATA:kvp}$"
],
"ignore_missing": true,
"ignore_failure": true
}
},
{
"rename": {
"field": "pid",
"target_field": "process.pid",
"ignore_missing": true
}
},
{
"convert": {
"field": "process.pid",
"type": "long",
"ignore_missing": true
}
},
{
"rename": {
"field": "program",
"target_field": "process.name",
"ignore_missing": true
}
},
{
"date": {
"field": "timestamp",
"formats": [
"MMM d HH:mm:ss",
"ISO8601"
],
"target_field": "@timestamp"
}
},
{
"remove": {
"field": "timestamp",
"ignore_missing": true
}
},
{
"rename": {
"field": "logsource",
"target_field": "host.name",
"ignore_missing": true
}
},
{
"remove": {
"field": [
"host.address",
"port"
],
"ignore_missing": true
}
},
{
"set": {
"field": "host.hostname",
"value": "{{_source.host.name}}"
}
},
{
"kv": {
"field": "kvp",
"field_split": "\\s;\\s",
"value_split": "=",
"target_field": "app.kvp",
"ignore_missing": true,
"strip_brackets": true
}
},
{
"remove": {
"field": "kvp",
"ignore_missing": true
}
},
{
"kv": {
"field": "kvp_1",
"field_split": "\\s",
"value_split": "(=|@)",
"target_field": "app.kvp",
"ignore_missing": true,
"strip_brackets": true
}
},
{
"remove": {
"field": "kvp_1",
"ignore_missing": true
}
},
{
"kv": {
"field": "kvp_2",
"field_split": "\\s",
"value_split": "(=|@)",
"target_field": "app.kvp",
"ignore_missing": true,
"strip_brackets": true
}
},
{
"remove": {
"field": "kvp_2",
"ignore_missing": true
}
},
{
"rename": {
"field": "action",
"target_field": "event.action",
"ignore_missing": true
}
},
{
"rename": {
"field": "user",
"target_field": "user.id",
"ignore_missing": true
}
},
{
"rename": {
"field": "app.kvp.USER",
"target_field": "user.id",
"ignore_missing": true
}
},
{
"set": {
"field": "user.name",
"value": "{{_source.user.id}}",
"ignore_empty_value": true
}
},
{
"append": {
"field": "process.name",
"value": [
"{{_source.subprocess}}"
],
"if": "ctx?.subprocess != null"
}
},
{
"remove": {
"field": "subprocess",
"ignore_missing": true
}
},
{
"rename": {
"field": "app.kvp.PWD",
"target_field": "process.working_directory",
"ignore_missing": true
}
},
{
"rename": {
"field": "app.kvp.COMMAND",
"target_field": "process.command_line",
"ignore_missing": true
}
},
{
"append": {
"field": "user.name",
"value": [
"{{_source.username}}"
],
"if": "ctx?.username != null"
}
},
{
"remove": {
"field": "username",
"ignore_missing": true
}
},
{
"append": {
"field": "user.id",
"value": [
"{{_source.user_id}}"
],
"if": "ctx?.user_id != null"
}
},
{
"remove": {
"field": "user_id",
"ignore_missing": true
}
},
{
"rename": {
"field": "app.kvp.eventId",
"target_field": "event.id",
"ignore_missing": true
}
},
{
"rename": {
"field": "app.kvp.eventSeverity",
"target_field": "log.level",
"ignore_missing": true
}
},
{
"lowercase": {
"field": "log.level",
"target_field": "log.level",
"ignore_missing": true
}
},
{
"rename": {
"field": "app.kvp.locationName",
"target_field": "host.geo.name",
"ignore_missing": true
}
},
{
"remove": {
"field": "host.geo",
"ignore_missing": true,
"if": "ctx?.host?.geo?.name != null && ctx.host.geo.name == '-'"
}
},
{
"rename": {
"field": "app.kvp.eventType",
"target_field": "event.action",
"ignore_missing": true
}
},
{
"lowercase": {
"field": "event.action",
"target_field": "event.action",
"ignore_missing": true
}
},
{
"rename": {
"field": "app.kvp.nodeIpAddress",
"target_field": "host.ip",
"ignore_missing": true
}
},
{
"set": {
"field": "event.status",
"value": "success",
"ignore_empty_value": true,
"if": "ctx?.app?.kvp?.status != null && ctx.app.kvp.status == 'success'"
}
},
{
"rename": {
"field": "facility",
"target_field": "log.syslog.facility.code",
"ignore_missing": true
}
},
{
"rename": {
"field": "app.kvp.profile",
"target_field": "app.profile",
"ignore_missing": true
}
},
{
"rename": {
"field": "app.kvp.ndc",
"target_field": "app.ndc",
"ignore_missing": true
}
},
{
"rename": {
"field": "app.kvp.mdc",
"target_field": "app.mdc",
"ignore_missing": true
}
},
{
"rename": {
"field": "app.kvp.parentSpanId",
"target_field": "app.span.parent.id",
"ignore_missing": true
}
},
{
"rename": {
"field": "app.kvp.spanId",
"target_field": "app.span.id",
"ignore_missing": true
}
},
{
"rename": {
"field": "app.kvp.objectType",
"target_field": "app.object.type",
"ignore_missing": true
}
},
{
"rename": {
"field": "app.kvp.objectName",
"target_field": "app.object.name",
"ignore_missing": true
}
},
{
"rename": {
"field": "app.kvp.objectId",
"target_field": "app.object.id",
"ignore_missing": true
}
},
{
"rename": {
"field": "app.kvp.jobId",
"target_field": "app.job.id",
"ignore_missing": true
}
},
{
"remove": {
"field": "app.job.id",
"ignore_missing": true,
"if": "ctx?.app?.job?.id != null && ctx.app.job.id == \"\""
}
},
{
"rename": {
"field": "app.kvp.jobType",
"target_field": "app.job.type",
"ignore_missing": true
}
},
{
"remove": {
"if": "ctx?.app?.job?.type != null && ctx.app.job.type == \"\"",
"field": "app.job.type",
"ignore_missing": true
}
},
{
"remove": {
"field": "app.job",
"ignore_missing": true,
"if": "ctx?.app?.job != null && ctx.app.job.isEmpty()"
}
},
{
"rename": {
"field": "app.kvp.instanceId",
"target_field": "app.instance.id",
"ignore_missing": true
}
},
{
"rename": {
"field": "app.kvp.clusterName",
"target_field": "app.cluster.name",
"ignore_missing": true
}
},
{
"rename": {
"field": "app.kvp.eventName",
"target_field": "app.event.name",
"ignore_missing": true
}
},
{
"rename": {
"field": "app.kvp.eventDetail",
"target_field": "app.event.detail",
"ignore_missing": true
}
},
{
"rename": {
"field": "app.kvp.eventSeriesId",
"target_field": "app.event.series.id",
"ignore_missing": true
}
},
{
"rename": {
"field": "app.kvp.taskId",
"target_field": "app.task.id",
"ignore_missing": true
}
},
{
"remove": {
"field": "app.task",
"ignore_missing": true,
"if": "ctx?.app?.task?.id != null && ctx.app.task.id == \"\""
}
},
{
"rename": {
"field": "app.kvp.status",
"target_field": "app.status",
"ignore_missing": true
}
},
{
"rename": {
"field": "app.kvp.tracerId",
"target_field": "app.tracer.id",
"ignore_missing": true
}
},
{
"rename": {
"field": "app.kvp.nodeId",
"target_field": "app.node.id",
"ignore_missing": true
}
},
{
"rename": {
"field": "sub_message",
"target_field": "app.message",
"ignore_missing": true
}
},
{
"rename": {
"field": "app.kvp",
"target_field": "app.unknown",
"ignore_missing": true
}
},
{
"remove": {
"field": "app.unknown",
"ignore_missing": true,
"if": "ctx?.app?.unknown != null && ctx.app.unknown.isEmpty()"
}
},
{
"rename": {
"field": "app",
"target_field": "process.title",
"ignore_missing": true
}
},
{
"set": {
"field": "event.outcome",
"value": "unknown",
"if": "ctx?.event?.outcome == null"
}
},
{
"set": {
"field": "event.action",
"value": "unknown",
"ignore_empty_value": true,
"if": "ctx?.event?.action == null"
}
}
],
"on_failure": [
{
"set": {
"field": "error.message",
"value": "{{ _ingest.on_failure_message }}"
}
}
]
}