{
  "description": "Pipeline for parsing elasticsearch slowlog logs",
  "processors": [
      {
          "rename": {
              "field": "@timestamp",
              "target_field": "event.created"
          }
      },
      {
          "grok": {
              "field": "message",
              "pattern_definitions" : {
                  "GREEDYMULTILINE" : "(.|\n)*",
                  "INDEXNAME": "[a-zA-Z0-9_.-]*"
              },
              "patterns": [
                  "\\[%{TIMESTAMP_ISO8601:elasticsearch.slowlog.timestamp}\\]\\[%{WORD:log.level}(%{SPACE}*)?\\]\\[%{DATA:elasticsearch.slowlog.logger}\\]%{SPACE}*\\[%{WORD:elasticsearch.node.name}\\](%{SPACE}*)?(\\[%{INDEXNAME:elasticsearch.index.name}\\]\\[%{NUMBER:elasticsearch.shard.id}\\])?(%{SPACE}*)?(\\[%{INDEXNAME:elasticsearch.index.name}\\/%{DATA:elasticsearch.index.id}\\])?(%{SPACE}*)?%{SPACE}*(took\\[%{DATA:elasticsearch.slowlog.took}\\],)?%{SPACE}*(took_millis\\[%{NUMBER:elasticsearch.slowlog.took_millis:int}\\],)?%{SPACE}*(type\\[%{DATA:elasticsearch.slowlog.type}\\],)?%{SPACE}*(id\\[%{DATA:elasticsearch.slowlog.id}\\],)?%{SPACE}*(routing\\[%{DATA:elasticsearch.slowlog.routing}\\],)?%{SPACE}*(total_hits\\[%{NUMBER:elasticsearch.slowlog.total_hits:int}\\],)?%{SPACE}*(types\\[%{DATA:elasticsearch.slowlog.types}\\],)?%{SPACE}*(stats\\[%{DATA:elasticsearch.slowlog.stats}\\],)?%{SPACE}*(search_type\\[%{DATA:elasticsearch.slowlog.search_type}\\],)?%{SPACE}*(total_shards\\[%{NUMBER:elasticsearch.slowlog.total_shards:int}\\],)?%{SPACE}*(source\\[%{GREEDYMULTILINE:elasticsearch.slowlog.source_query}\\])?,?%{SPACE}*(extra_source\\[%{DATA:elasticsearch.slowlog.extra_source}\\])?,?"
              ]
          }
      },
      {
          "rename": {
              "field": "elasticsearch.slowlog.timestamp",
              "target_field": "@timestamp"
          }
      }
    ],
  "on_failure" : [{
    "set" : {
      "field" : "error.message",
      "value" : "{{ _ingest.on_failure_message }}"
    }
  }]
}
