description: Pipeline for parsing MongoDB logs
processors:
- set:
    field: event.ingested
    value: '{{_ingest.timestamp}}'
- set:
    copy_from: '@timestamp'
    field: event.created
- grok:
    field: message
    patterns:
    - ^%{CHAR:first_char}
    pattern_definitions:
      CHAR: .
- pipeline:
    if: ctx.first_char != '{'
    name: '{< IngestPipeline "pipeline-plaintext" >}'
- pipeline:
    if: ctx.first_char == '{'
    name: '{< IngestPipeline "pipeline-json" >}'
- set:
    field: event.kind
    value: event
- append:
    field: event.category
    value: database
- remove:
    field:
    - first_char
on_failure:
- set:
    field: error.message
    value: '{{ _ingest.on_failure_message }}'