At first, I tried to create a pipeline :
PUT /_ingest/pipeline/filetest
{
"description": "Pipeline for parsing Syslog messages.",
"processors": [
{
"grok": {
"ignore_missing": true,
"field": "message",
"patterns": [
"%{HOSTNAME:hote}_%{DATA:val} %{WORD:process}\\[%{NUMBER:procces_pid}\\]: %{DATA:msg}: %{WORD:protocole} %{WORD:peer} %{IP:client} \\(%{DATA:AS}%{NUMBER:AS_nb}\\) %{DATA:etat} \\(%{DATA:evenement}\\) \\(%{DATA:instance}\\)"
]
}
}
]
}
but it didn't work, so I tried to add my grok to one of the preexistent pipelines (it doesn't have my grok in it) :
PUT /_ingest/pipeline/filebeat-7.5.2-system-syslog-pipeline
{
"description" : "Pipeline for parsing Syslog messages.",
"processors" : [
{
"grok" : {
"pattern_definitions" : {
"GREEDYMULTILINE" : "(.|)*"
},
"ignore_missing" : true,
"field" : "message",
"patterns" : [
"%{SYSLOGTIMESTAMP:system.syslog.timestamp} %{SYSLOGHOST:host.hostname} %{DATA:process.name} (?:\\[%{POSINT:process.pid:long}\\])?: %{GREEDYMULTILINE:system.syslog.message}",
"%{SYSLOGTIMESTAMP:system.syslog.timestamp} %{GREEDYMULTILINE:system.syslog.message}",
"%{TIMESTAMP_ISO8601:system.syslog.timestamp} %{SYSLOGHOST:host.hostname} %{DATA:process.name}(?:\\[%{POSINT:process.pid:long}\\])?: %{GREEDYMULTILINE:system.syslog.message}",
]
}
},
{
"rename" : {
"field" : "system.syslog.message",
"target_field" : "message",
"ignore_missing" : true
}
},
{
"date" : {
"formats" : [
"MMM d HH:mm:ss",
"MMM dd HH:mm:ss",
"MMM d HH:mm:ss",
"ISO8601"
],
"on_failure" : [
{
"append" : {
"field" : "error.message",
"value" : "{{ _ingest.on_failure_message }}"
}
}
],
"if" : "ctx.event.timezone == null",
"field" : "system.syslog.timestamp",
"target_field" : "@timestamp"
}
},
{
"date" : {
"if" : "ctx.event.timezone != null",
"field" : "system.syslog.timestamp",
"target_field" : "@timestamp",
"formats" : [
"MMM d HH:mm:ss",
"MMM dd HH:mm:ss",
"MMM d HH:mm:ss",
"ISO8601"
],
"timezone" : "{{ event.timezone }}",
"on_failure" : [
{
"append" : {
"field" : "error.message",
"value" : "{{ _ingest.on_failure_message }}"
}
}
]
}
},
{
"remove" : {
"field" : "system.syslog.timestamp"
}
}
],
"on_failure" : [
{
"set" : {
"field" : "error.message",
"value" : "{{ _ingest.on_failure_message }}"
}
}
]
}
and it also fails pitifully.