pipeline.json

{
	"description": "Pipeline for parsing Syslog messages.",
	"processors": [
		{
			"grok": {
				"field": "message",
				"patterns": [
					"%{SYSLOGTIMESTAMP:system.syslog.timestamp} %{SYSLOGHOST:system.syslog.hostname} %{DATA:system.syslog.program}(?:\\[%{POSINT:system.syslog.pid}\\])?: %{GREEDYMULTILINE:system.syslog.message}",
					"%{SYSLOGTIMESTAMP:system.syslog.timestamp} %{GREEDYMULTILINE:system.syslog.message}"
				],
        "pattern_definitions" : {
          "GREEDYMULTILINE" : "(.|\n)*"
        },
        "ignore_missing": true
			}
    },
		{
      "remove": {
        "field": "message"
      }
    },
    {
      "date": {
        "field": "system.syslog.timestamp",
        "target_field": "@timestamp",
        "formats": [
					"MMM  d HH:mm:ss",
					"MMM dd HH:mm:ss"
        ],
        {< if .convert_timezone >}"timezone": "{{ beat.timezone }}",{< end >}
        "ignore_failure": true
      }
    }
	],
  "on_failure" : [{
    "set" : {
      "field" : "error.message",
      "value" : "{{ _ingest.on_failure_message }}"
    }
  }]
}