description: Pipeline for parsing Kibana ECS audit logs
processors:
- set:
    field: event.ingested
    value: '{{_ingest.timestamp}}'
- set:
    copy_from: '@timestamp'
    field: event.created
- script:
    lang: painless
    if: 'ctx.json != null'
    description: Merges filebeat generated fields with ECS log content
    source: |-
      ctx.json.keySet().each(key -> ctx.merge(key, ctx.json.get(key), (oldValue, newValue) -> {
        if (newValue instanceof Map) {
          newValue.putAll(oldValue);
        }

        return newValue;
      }))
- script:
    lang: painless
    description: Overrides log entry with custom field values. Applicable when fields_under_root is true
    if: "ctx.fields != null"
    source: |-
      ctx.fields.keySet().each(key -> ctx.merge(key, ctx.fields.get(key), (oldValue, newValue) -> {
        if (oldValue instanceof Map) {
          oldValue.putAll(newValue);
        }

        return oldValue;
      }));
- remove:
    field: fields
    ignore_missing: true
- remove:
    field: json
    ignore_missing: true
