{
  "description": "Pipeline for parsing azure activity logs.",
  "processors": [
      {
          "script": {
              "source": "ctx.message = ctx.message.replace(params.empty_field_name, '')",
              "params": {
                  "empty_field_name":  "\"\":\"\","
              },
              "ignore_failure": true
          }
      },
      {
          "json" : {
              "field" : "message",
              "target_field" : "azure.activitylogs"
          }
      },
      {
          "date": {
              "field": "azure.activitylogs.time",
              "target_field": "@timestamp",
              "ignore_failure": true,
              "formats": [
                  "ISO8601"
              ]
          }
      },
      {
          "remove": {
              "field": ["message", "azure.activitylogs.time"],
              "ignore_missing": true
          }
      },
      {
          "rename": {
              "field": "azure.activitylogs.resourceId",
              "target_field": "azure.resource_id",
              "ignore_missing": true
          }
      },
      {
          "rename": {
              "field": "azure.activitylogs.callerIpAddress",
              "target_field": "source.ip",
              "ignore_missing": true
          }
      },
      {
          "rename": {
              "field": "azure.activitylogs.level",
              "target_field": "log.level",
              "ignore_missing": true
          }
      },
      {
          "rename": {
              "field": "azure.activitylogs.durationMs",
              "target_field": "event.duration",
              "ignore_missing": true
          }
      },
      {
          "script": {
              "lang": "painless",
              "source": "if (ctx.event.duration!= null) {ctx.event.duration = ctx.event.duration * params.param_nano;}",
              "params": {
                  "param_nano": 1000000
              },
              "ignore_failure": true
          }
      },
      {
          "rename": {
              "field": "azure.activitylogs.location",
              "target_field": "geo.name",
              "ignore_missing": true
          }
      },
      {
          "script": {
              "lang": "painless",
              "source": "if (ctx.azure.activitylogs.properties != null && ctx.azure.activitylogs.properties.eventCategory != null) {ctx.eventCategory = ctx.azure.activitylogs.properties.eventCategory} if (ctx.azure.activitylogs.properties != null && ctx.azure.activitylogs.properties.policies != null)  { ctx.eventCategory = 'Policy'}  if (ctx.eventCategory == null) {ctx.eventCategory='Administrative'}",
              "ignore_failure": true
          }
      },
      {
          "rename": {
              "field": "eventCategory",
              "target_field": "event.category",
              "ignore_missing": true
          }
      },
      {
          "rename": {
              "field": "azure.activitylogs.resultType",
              "target_field": "event.outcome",
              "ignore_missing": true
          }
      },
      {
          "rename": {
              "field": "azure.activitylogs.operationName",
              "target_field": "azure.activitylogs.operation_name",
              "ignore_missing": true
          }
      },
      {
          "rename": {
              "field": "azure.activitylogs.resultSignature",
              "target_field": "azure.activitylogs.result_signature",
              "ignore_missing": true
          }
      },
      {
          "rename": {
              "field": "azure.activitylogs.identity.authorization.evidence.roleAssignmentScope",
              "target_field": "azure.activitylogs.identity.authorization.evidence.role_assignment_scope",
              "ignore_missing": true
          }
      },
      {
          "rename": {
              "field": "azure.activitylogs.identity.authorization.evidence.roleDefinitionId",
              "target_field": "azure.activitylogs.identity.authorization.evidence.role_definition_id",
              "ignore_missing": true
          }
      },
      {
          "rename": {
              "field": "azure.activitylogs.identity.authorization.evidence.roleAssignmentId",
              "target_field": "azure.activitylogs.identity.authorization.evidence.role_assignment_id",
              "ignore_missing": true
          }
      },
      {
          "rename": {
              "field": "azure.activitylogs.identity.authorization.evidence.principalId",
              "target_field": "azure.activitylogs.identity.authorization.evidence.principal_id",
              "ignore_missing": true
          }
      },
      {
          "rename": {
              "field": "azure.activitylogs.identity.authorization.evidence.principalType",
              "target_field": "azure.activitylogs.identity.authorization.evidence.principal_type",
              "ignore_missing": true
          }
      },
      {
          "rename": {
              "field": "azure.activitylogs.correlationId",
              "target_field": "azure.correlation_id",
              "ignore_missing": true
          }
      },
      {
          "rename": {
              "field": "azure.activitylogs.properties.serviceRequestId",
              "target_field": "azure.activitylogs.properties.service_request_id",
              "ignore_missing": true
          }
      },
      {
          "rename": {
              "field": "azure.activitylogs.properties.statusMessage",
              "target_field": "message",
              "ignore_missing": true
          }
      },
      {
          "rename": {
              "field": "azure.activitylogs.properties.statusCode",
              "target_field": "azure.activitylogs.properties.status_code",
              "ignore_missing": true
          }
      },
      {
          "geoip" : {
              "field" : "source.ip",
              "target_field" : "geo",
              "ignore_missing": true
          }
      },
      {
          "rename": {
              "field": "azure.activitylogs.identity.claims.name",
              "target_field": "azure.activitylogs.identity.claims_initiated_by_user.fullname",
              "ignore_missing": true
          }
      },
      {
          "script": {
              "lang": "painless",
              "source": "if (ctx.azure.activitylogs.identity.claims['http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname'] != null) {  ctx.azure.activitylogs.identity.claims_initiated_by_user.surname = ctx.azure.activitylogs.identity.claims['http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname'];}",
              "ignore_failure": true
          }
      },
      {
          "script": {
              "lang": "painless",
              "source": "if (ctx.azure.activitylogs.identity.claims['http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name'] != null) {  ctx.azure.activitylogs.identity.claims_initiated_by_user.name = ctx.azure.activitylogs.identity.claims['http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name'];}",
              "ignore_failure": true
          }
      },
      {
          "script": {
              "lang": "painless",
              "source": "if (ctx.azure.activitylogs.identity.claims['http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname'] != null) {  ctx.azure.activitylogs.identity.claims_initiated_by_user.givenname = ctx.azure.activitylogs.identity.claims['http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname'];}",
              "ignore_failure": true
          }
      },
      {
          "set": {
              "if" : "ctx.azure.activitylogs.identity!= null && ctx.azure.activitylogs.identity.claims_initiated_by_user != null && ctx.azure.activitylogs.identity.claims_initiated_by_user.name != null",
              "field": "azure.activitylogs.identity.claims_initiated_by_user.schema",
              "value": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims",
              "ignore_failure": true
          }
      },
      {
          "script": {
              "lang": "painless",
              "source": "if (ctx.azure.activitylogs.identity.claims != null) { ctx.temp_claims = new HashMap(); for (String key : ctx.azure.activitylogs.identity.claims.keySet()) {  ctx.temp_claims[key.replace('.', '_')] = ctx.azure.activitylogs.identity.claims.get(key) ;}ctx.azure.activitylogs.identity.claims = ctx.temp_claims; ctx.remove('temp_claims');}",
              "ignore_failure": true
          }
      },
      {
          "pipeline": {
              "name": "{< IngestPipeline "azure-shared-pipeline" >}"
          }
      }
  ],
  "on_failure": [
  {
    "set": {
      "field": "error.message",
      "value": "{{ _ingest.on_failure_message }}"
    }
  }
  ]
}
