description: Pipeline for parsing Syslog messages.
processors:
- set:
    field: event.ingested
    value: '{{_ingest.timestamp}}'
- grok:
    field: message
    patterns:
    - '%{SYSLOGTIMESTAMP:system.syslog.timestamp} %{SYSLOGHOST:host.hostname} %{DATA:process.name}(?:\[%{POSINT:process.pid:long}\])?:
      %{GREEDYMULTILINE:system.syslog.message}'
    - '%{SYSLOGTIMESTAMP:system.syslog.timestamp} %{GREEDYMULTILINE:system.syslog.message}'
    - '%{TIMESTAMP_ISO8601:system.syslog.timestamp} %{SYSLOGHOST:host.hostname} %{DATA:process.name}(?:\[%{POSINT:process.pid:long}\])?:
      %{GREEDYMULTILINE:system.syslog.message}'
    pattern_definitions:
      GREEDYMULTILINE: |-
        (.|
        )*
    ignore_missing: true
- remove:
    field: message
- rename:
    field: system.syslog.message
    target_field: message
    ignore_missing: true
- date:
    if: ctx.event.timezone == null
    field: system.syslog.timestamp
    target_field: '@timestamp'
    formats:
    - MMM  d HH:mm:ss
    - MMM dd HH:mm:ss
    - MMM d HH:mm:ss
    - ISO8601
    on_failure:
    - append:
        field: error.message
        value: '{{ _ingest.on_failure_message }}'
- date:
    if: ctx.event.timezone != null
    field: system.syslog.timestamp
    target_field: '@timestamp'
    formats:
    - MMM  d HH:mm:ss
    - MMM dd HH:mm:ss
    - MMM d HH:mm:ss
    - ISO8601
    timezone: '{{ event.timezone }}'
    on_failure:
    - append:
        field: error.message
        value: '{{ _ingest.on_failure_message }}'
- remove:
    field: system.syslog.timestamp
- set:
    field: event.kind
    value: event
- append:
    field: related.hosts
    value: "{{host.hostname}}"
    if: "ctx.host?.hostname != null && ctx.host?.hostname != ''"
    allow_duplicates: false
on_failure:
- set:
    field: error.message
    value: '{{ _ingest.on_failure_message }}'