pipeline-json.json

{
    "description": "Pipeline for parsing the Elasticsearch deprecation log file in JSON format.",
    "on_failure": [
        {
            "set": {
                "field": "error.message",
                "value": "{{ _ingest.on_failure_message }}"
            }
        }
    ],
    "processors": [
        {
            "json": {
                "field": "message",
                "target_field": "elasticsearch.deprecation"
            }
        },
        {
            "drop": {
                "if": "ctx.elasticsearch.deprecation.type != 'deprecation'"
            }
        },
        {
            "remove": {
                "field": "elasticsearch.deprecation.type"
            }
        },
        {
            "rename": {
                "field": "elasticsearch.deprecation.level",
                "target_field": "log.level"
            }
        },
        {
            "rename": {
                "field": "elasticsearch.deprecation.component",
                "target_field": "elasticsearch.component"
            }
        },
        {
            "dot_expander": {
                "field": "cluster.name",
                "path": "elasticsearch.deprecation"
            }
        },
        {
            "rename": {
                "field": "elasticsearch.deprecation.cluster.name",
                "target_field": "elasticsearch.cluster.name"
            }
        },
        {
            "dot_expander": {
                "field": "node.name",
                "path": "elasticsearch.deprecation"
            }
        },
        {
            "rename": {
                "field": "elasticsearch.deprecation.node.name",
                "target_field": "elasticsearch.node.name"
            }
        },
        {
            "dot_expander": {
                "field": "cluster.uuid",
                "path": "elasticsearch.deprecation"
            }
        },
        {
            "rename": {
                "field": "elasticsearch.deprecation.cluster.uuid",
                "target_field": "elasticsearch.cluster.uuid",
                "ignore_missing": true
            }
        },
        {
            "dot_expander": {
                "field": "node.id",
                "path": "elasticsearch.deprecation"
            }
        },
        {
            "rename": {
                "field": "elasticsearch.deprecation.node.id",
                "target_field": "elasticsearch.node.id",
                "ignore_missing": true
            }
        },
        {
            "remove": {
                "field": "message"
            }
        },
        {
            "rename": {
                "field": "elasticsearch.deprecation.message",
                "target_field": "message"
            }
        },
        {
            "date": {
                "field": "elasticsearch.deprecation.timestamp",
                "target_field": "@timestamp",
                "formats": [
                    "ISO8601"
                ],
                "ignore_failure": true
            }
        }
    ]
}