{
    "description": "Pipeline for parsing the Elasticsearch slow logs in JSON format.",
    "on_failure": [
        {
            "set": {
                "field": "error.message",
                "value": "{{ _ingest.on_failure_message }}"
            }
        }
    ],
    "processors": [
        {
            "json": {
                "field": "message",
                "target_field": "elasticsearch.slowlog"
            }
        },
        {
            "drop": {
                "if": "ctx.elasticsearch.slowlog.type != 'index_indexing_slowlog' && ctx.elasticsearch.slowlog.type != 'index_search_slowlog'"
            }
        },
        {
            "remove": {
                "field": "elasticsearch.slowlog.type"
            }
        },
        {
            "rename": {
                "field": "elasticsearch.slowlog.level",
                "target_field": "log.level"
            }
        },
        {
            "rename": {
                "field": "elasticsearch.slowlog.component",
                "target_field": "elasticsearch.component"
            }
        },
        {
            "dot_expander": {
                "field": "cluster.name",
                "path": "elasticsearch.slowlog"
            }
        },
        {
            "rename": {
                "field": "elasticsearch.slowlog.cluster.name",
                "target_field": "elasticsearch.cluster.name"
            }
        },
        {
            "dot_expander": {
                "field": "node.name",
                "path": "elasticsearch.slowlog"
            }
        },
        {
            "rename": {
                "field": "elasticsearch.slowlog.node.name",
                "target_field": "elasticsearch.node.name"
            }
        },
        {
            "dot_expander": {
                "field": "cluster.uuid",
                "path": "elasticsearch.slowlog"
            }
        },
        {
            "rename": {
                "field": "elasticsearch.slowlog.cluster.uuid",
                "target_field": "elasticsearch.cluster.uuid",
                "ignore_missing": true
            }
        },
        {
            "dot_expander": {
                "field": "node.id",
                "path": "elasticsearch.slowlog"
            }
        },
        {
            "rename": {
                "field": "elasticsearch.slowlog.node.id",
                "target_field": "elasticsearch.node.id",
                "ignore_missing": true
            }
        },
        {
            "rename": {
                "field": "elasticsearch.slowlog.doc_type",
                "target_field": "elasticsearch.slowlog.types",
                "ignore_missing": true
            }
        },
        {
            "convert": {
                "field": "elasticsearch.slowlog.took_millis",
                "type": "float",
                "ignore_missing": true
            }
        },
        {
            "rename": {
                "field": "elasticsearch.slowlog.took_millis",
                "target_field": "elasticsearch.slowlog.duration",
                "ignore_missing": true
            }
        },
        {
            "grok": {
                "field": "elasticsearch.slowlog.message",
                "pattern_definitions" : {
                    "GREEDYMULTILINE" : "(.|\n)*",
                    "INDEXNAME": "[a-zA-Z0-9_.-]*"
                },
                "patterns": [
                    "(\\[%{INDEXNAME:elasticsearch.index.name}\\]\\[%{NUMBER:elasticsearch.shard.id}\\])?(%{SPACE})?(\\[%{INDEXNAME:elasticsearch.index.name}\\/%{DATA:elasticsearch.index.id}\\])?(%{SPACE})?%{SPACE}(took\\[%{DATA:elasticsearch.slowlog.took}\\],)?%{SPACE}(took_millis\\[%{NUMBER:elasticsearch.slowlog.duration:long}\\],)?%{SPACE}(type\\[%{DATA:elasticsearch.slowlog.type}\\],)?%{SPACE}(id\\[%{DATA:elasticsearch.slowlog.id}\\],)?%{SPACE}(routing\\[%{DATA:elasticsearch.slowlog.routing}\\],)?%{SPACE}(total_hits\\[%{NUMBER:elasticsearch.slowlog.total_hits:int}\\],)?%{SPACE}(types\\[%{DATA:elasticsearch.slowlog.types}\\],)?%{SPACE}(stats\\[%{DATA:elasticsearch.slowlog.stats}\\],)?%{SPACE}(search_type\\[%{DATA:elasticsearch.slowlog.search_type}\\],)?%{SPACE}(total_shards\\[%{NUMBER:elasticsearch.slowlog.total_shards:int}\\],)?%{SPACE}(source\\[%{GREEDYMULTILINE:elasticsearch.slowlog.source_query}\\])?,?%{SPACE}(extra_source\\[%{DATA:elasticsearch.slowlog.extra_source}\\])?,?",
                    "\\[%{INDEXNAME:elasticsearch.index.name}\\]\\[%{NUMBER:elasticsearch.shard.id}\\]"
                ]
            }
        },
        {
            "remove": {
                "field": "elasticsearch.slowlog.message"
            }
        },
        {
            "date": {
                "field": "elasticsearch.slowlog.timestamp",
                "target_field": "@timestamp",
                "formats": [
                    "ISO8601"
                ],
                "ignore_failure": true
            }
        }
    ]
}
