{
  "description": "Pipeline for parsing MongoDB logs",
  "processors": [{
    "grok": {
      "field": "message",
      "patterns":[
          "%{TIMESTAMP_ISO8601:mongodb.log.timestamp}%{SPACE}%{MONGO3_SEVERITY:log.level}%{SPACE}%{MONGO3_COMPONENT:mongodb.log.component}%{SPACE}(?:\\[%{DATA:mongodb.log.context}\\])?%{SPACE}%{GREEDYDATA:message}"
      ],
      "ignore_missing": true
    }
  },
  {
    "rename": {
      "field": "@timestamp",
      "target_field": "event.created"
    }
  },
  {
    "date": {
      "field": "mongodb.log.timestamp",
      "target_field": "@timestamp",
      "formats": ["yyyy-MM-dd'T'HH:mm:ss.SSSZZ"]
    }
  },
  {
    "remove": {
      "field": "mongodb.log.timestamp"
    }
  }],
  "on_failure" : [{
    "set" : {
      "field" : "error.message",
      "value" : "{{ _ingest.on_failure_message }}"
    }
  }]
}
