{
    "description": "Pipeline for parsing Kibana logs",
    "on_failure": [
        {
            "set": {
                "field": "error.message",
                "value": "{{ _ingest.on_failure_message }}"
            }
        }
    ],
    "processors": [
        {
            "rename": {
                "field": "@timestamp",
                "target_field": "event.created"
            }
        },

        {
            "rename": {
                "field": "json",
                "target_field": "kibana.log.meta"
            }
        },
        {
            "date": {
                "field": "kibana.log.meta.@timestamp",
                "formats" : ["ISO8601"],
                "target_field": "@timestamp"
            }
        },
        {
            "remove": {
                "field": "kibana.log.meta.@timestamp"
            }
        },

        {
            "rename": {
                "field": "kibana.log.meta.message",
                "target_field": "message"
            }
        },
        {
            "rename": {
                "field": "kibana.log.meta.state",
                "target_field": "kibana.log.state",
                "ignore_missing": true
            }
        },
        {
            "rename": {
                "field": "kibana.log.meta.pid",
                "target_field": "process.pid"
            }
        },
        {
            "rename": {
                "field": "kibana.log.meta.tags",
                "target_field": "kibana.log.tags"
            }
        },
        {
            "rename": {
                "field": "kibana.log.meta.res.statusCode",
                "target_field": "http.response.status_code",
                "ignore_missing": true
            }
        },
        {
            "rename": {
                "field": "kibana.log.meta.res.responseTime",
                "target_field": "temp.duration",
                "ignore_missing": true
            }
        },
        {
            "script": {
                "lang": "painless",
                "source": "ctx.event.duration = Math.round(ctx.temp.duration * params.scale)",
                "params": { "scale": 1000000 },
                "if": "ctx.temp?.duration != null"
            }

        },
        {
            "remove": {
                "field": "temp.duration",
                "ignore_missing": true
            }
        },
        {
            "rename": {
                "field": "kibana.log.meta.res.contentLength",
                "target_field": "http.response.body.bytes",
                "ignore_missing": true
            }
        },
        {
            "rename": {
                "field": "kibana.log.meta.req.method",
                "target_field": "http.request.method",
                "ignore_missing": true
            }
        },

        {
            "rename": {
                "field": "kibana.log.meta.req.headers.referer",
                "target_field": "http.request.referrer",
                "ignore_missing": true
            }
        },
        {
            "rename": {
                "field": "kibana.log.meta.req.headers.user-agent",
                "target_field": "user_agent.original",
                "ignore_missing": true
            }
        },
        {
            "rename": {
                "field": "kibana.log.meta.req.remoteAddress",
                "target_field": "source.address",
                "ignore_missing": true
            }
        },
        {
            "set": {
                "field": "source.ip",
                "value": "{{source.address}}",
                "if": "ctx.source?.address != null"
            }
        },
        {
            "rename": {
                "field": "kibana.log.meta.req.url",
                "target_field": "url.original",
                "ignore_missing": true
            }
        },

        {
            "remove": {
                "field": "kibana.log.meta.req.referer",
                "ignore_missing": true
            }
        },
        {
            "remove": {
                "field": "kibana.log.meta.statusCode",
                "ignore_missing": true
            }
        },
        {
            "remove": {
                "field": "kibana.log.meta.method",
                "ignore_missing": true
            }
        },

        {
            "append": {
                "field": "service.name",
                "value": "kibana"
            }
        }
    ]
}
