Filebeats with postgresql module, custom log_line_prefix

Elastic Stack Beats
4

Solved by changing the pipeline pattern

PUT /_ingest/pipeline/filebeat-7.4.0-postgresql-log-pipeline
{
    "description": "Pipeline for parsing PostgreSQL logs.",
    "processors": [
      {
        "grok": {
          "ignore_missing": true,
          "patterns": [
            "^%{DATETIME:postgresql.log.timestamp} \\[%{NUMBER:process.pid:long}\\]: db=%{POSTGRESQL_DB_NAME:postgresql.log.database},user=%{USERNAME:user.name},app=%{DATA:postgresql.log.app},client=%{IP:postgresql.log.client} %{WORD:log.level}:  (?:%{NUMBER:postgresql.log.error.code:long}|%{SPACE})(duration: %{NUMBER:temp.duration:float} ms  statement: %{GREEDYDATA:postgresql.log.query}|: %{GREEDYDATA:message}|%{GREEDYDATA:message})"
          ],
          "pattern_definitions": {
            "DATETIME": "[-0-9]+ %{TIME} %{WORD:event.timezone}",
            "GREEDYDATA": "(.|\n|\t)*",
            "POSTGRESQL_DB_NAME": "[a-zA-Z0-9_]+[a-zA-Z0-9_\\$]*"
          },
          "field": "message"
        }
      },
      {
        "date": {
          "target_field": "@timestamp",
          "formats": [
            "yyyy-MM-dd HH:mm:ss.SSS zz",
            "yyyy-MM-dd HH:mm:ss zz"
          ],
          "field": "postgresql.log.timestamp"
        }
      },
      {
        "script": {
          "lang": "painless",
          "source": "ctx.event.duration = Math.round(ctx.temp.duration * params.scale)",
          "params": {
            "scale": 1000000.0
          },
          "if": "ctx.temp?.duration != null"
        }
      },
      {
        "remove": {
          "field": "temp.duration",
          "ignore_missing": true
        }
      }
    ],
    "on_failure": [
      {
        "set": {
          "field": "error.message",
          "value": "{{ _ingest.on_failure_message }}"
        }
      }
    ]
  }