description: Pipeline for parsing Kibana audit logs
processors:
- set:
    field: event.ingested
    value: '{{_ingest.timestamp}}'
- rename:
    field: '@timestamp'
    target_field: event.created
- pipeline:
    name: '{< IngestPipeline "pipeline-json" >}'
- set:
    field: event.kind
    value: event
- append:
    field: related.user
    value: "{{user.name}}"
    if: "ctx?.user?.name != null"
on_failure:
- set:
    field: error.message
    value: '{{ _ingest.on_failure_message }}'
