{
  "description": "Pipeline for dissecting text in plaintext logs",
  "processors": [
    {
      "dissect": {
        "field": "message",
        "pattern": "%{timestamp} [%{log.level}] %{temp.source} - %{coredns.id} \"%{coredns.query.type} %{coredns.query.class} %{coredns.query.name} %{network.transport} %{coredns.query.size} %{coredns.dnssec_ok} %{bufsize}\" %{coredns.response.code} %{coredns.response.flags} %{coredns.response.size} %{coredns.duration}s"
       }
    },
    {
      "remove": {
        "field": ["bufsize"],
        "ignore_failure" : true
      }
    }
  ],
  "on_failure" : [{ 
    "set" : { 
      "field" : "error.message", 
      "value" : "{{ _ingest.on_failure_message }}" 
    } 
  }]
}
