---
description: Pipeline for parsing RabbitMQ logs
processors:
- set:
    field: event.ingested
    value: '{{_ingest.timestamp}}'
- grok:
    field: message
    pattern_definitions:
      GREEDYMULTILINE: "(.|\n)*"
      ERL_PID: "\\<%{INT}+\\.%{INT}+\\.%{INT}+\\>"
    patterns:
    - "%{DATESTAMP:timestamp} \\[%{WORD:log.level}\\] %{ERL_PID:rabbitmq.log.pid}
      %{GREEDYMULTILINE:message}"
    ignore_missing: true
- date:
    if: "ctx.event.timezone == null"
    field: timestamp
    target_field: "@timestamp"
    formats:
    - yy-MM-dd HH:mm:ss.SSS
- date:
    if: "ctx.event.timezone != null"
    field: "timestamp"
    target_field: "@timestamp"
    timezone: "{{ event.timezone }}"
    formats:
    - yy-MM-dd HH:mm:ss.SSS
- remove:
    field:
    - timestamp
- set:
    field: event.kind
    value: event
on_failure:
- set:
    field: error.message
    value: "{{ _ingest.on_failure_message }}"
