description: Pipeline for parsing ClusterMgr logs.
processors:
- set:
    field: event.ingested
    value: '{{_ingest.timestamp}}'
- grok:
    field: message
    ignore_missing: true
    patterns:
    - '%{DATA:clustermgr.log.timestamp}%{SPACE}(\<%{DATA:clustermgr.log.thread_id}\>%{SPACE})?(\[%{DATA:clustermgr.log.log_level}\]%{SPACE})%{GREEDYDATA:clustermgr.log.message}'

- script:
    lang: painless
    source: ctx.event.duration = Math.round(ctx.temp.duration * params.scale)
    params:
      scale: 1000000
    if: ctx.temp?.duration != null
- remove:
    field: temp.duration
    ignore_missing: true
- set:
    field: event.kind
    value: event
- append:
    field: event.category
    value:
      - database
- append:
    field: event.type
    value:
      - info
- append:
    field: related.user
    value: "{{user.name}}"
    if: "ctx?.user?.name != null"
on_failure:
- set:
    field: error.message
    value: '{{ _ingest.on_failure_message }}'
