description: Pipeline for parsing azure activity logs.
processors:
- set:
    field: cloud.provider
    value: azure
- grok:
    field: azure.resource_id
    patterns:
    - /SUBSCRIPTIONS/%{SUBID:azure.subscription_id}/RESOURCEGROUPS/%{GROUPID:azure.resource.group}/PROVIDERS/%{PROVIDERNAME:azure.resource.provider}/NAMESPACES/%{NAMESPACE:azure.resource.namespace}/AUTHORIZATIONRULES/%{RULE:azure.resource.authorization_rule}
    pattern_definitions:
      SUBID: (\{){0,1}[0-9a-fA-F]{8}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{12}(\}){0,1}
      GROUPID: .+
      PROVIDERNAME: .+
      NAMESPACE: .+
      RULE: .+
    ignore_failure: true
- grok:
    field: azure.resource_id
    patterns:
    - /SUBSCRIPTIONS/%{SUBID:azure.subscription_id}/RESOURCEGROUPS/%{GROUPID:azure.resource.group}/PROVIDERS/%{PROVIDERNAME:azure.resource.provider}/%{NAME:azure.resource.name}
    pattern_definitions:
      SUBID: (\{){0,1}[0-9a-fA-F]{8}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{12}(\}){0,1}
      GROUPID: .+
      PROVIDERNAME: ([A-Z])\w+.([A-Z])\w+/([A-Z])\w+.
      NAME: ((?!AUTHORIZATIONRULES).)*$
    ignore_failure: true
- grok:
    field: azure.resource_id
    patterns:
    - /providers/%{PROVIDER:azure.resource.provider}
    pattern_definitions:
      PROVIDER: .+
    ignore_failure: true
- rename:
    field: azure.resource_id
    target_field: azure.resource.id
    ignore_missing: true
- lowercase:
    field: event.outcome
    ignore_missing: true
on_failure:
- set:
    field: error.message
    value: '{{ _ingest.on_failure_message }}'
