{
    "description": "Pipeline for parsing logstash logs in the plain format",
    "on_failure": [
        {
            "set": {
                "field": "error.message",
                "value": "{{ _ingest.on_failure_message }}"
            }
        }
    ],
    "processors": [
        {
            "grok": {
                "field": "message",
                "pattern_definitions": {
                    "LOGSTASH_CLASS_MODULE": "[\\w\\.]+",
                    "LOGSTASH_LOGLEVEL": "INFO|ERROR|DEBUG|FATAL|WARN|TRACE",
                    "GREEDYMULTILINE" : "(.|\n)*"
                },
                "patterns": [
                    "\\[%{TIMESTAMP_ISO8601:logstash.log.timestamp}\\]\\[%{LOGSTASH_LOGLEVEL:log.level}\\s?\\]\\[%{LOGSTASH_CLASS_MODULE:logstash.log.module}\\s*\\]\\[%{WORD:logstash.log.pipeline_id}\\] %{GREEDYMULTILINE:message}",
                    "\\[%{TIMESTAMP_ISO8601:logstash.log.timestamp}\\]\\[%{LOGSTASH_LOGLEVEL:log.level}\\s?\\]\\[%{LOGSTASH_CLASS_MODULE:logstash.log.module}\\s*\\] %{GREEDYMULTILINE:message}"
                ]
            }
        },
        {
            "rename": {
                "field": "@timestamp",
                "target_field": "event.created"
            }
        },
        {
            "date": {
                "if": "ctx.event.timezone == null",
                "field": "logstash.log.timestamp",
                "target_field": "@timestamp",
                "formats": ["yyyy-MM-dd'T'HH:mm:ss,SSS"],
                "on_failure": [{"append": {"field": "error.message", "value": "{{ _ingest.on_failure_message }}"}}]
            }
        },
        {
            "date": {
                "if": "ctx.event.timezone != null",
                "field": "logstash.log.timestamp",
                "target_field": "@timestamp",
                "formats": ["yyyy-MM-dd'T'HH:mm:ss,SSS"],
                "timezone": "{{ event.timezone }}",
                "on_failure": [{"append": {"field": "error.message", "value": "{{ _ingest.on_failure_message }}"}}]
            }
        },
        {
            "remove": {
                "field": "logstash.log.timestamp"
            }
        }
    ]
}
