Zoneminder zmc_m#.log ECS Compliant Ingest Node Pipeline Processor

gistfile1.txt

PUT _ingest/pipeline/zoneminder-c
{
  "processors": [
    {
      "dissect": {
        "field": "message",
        "pattern": "%{Date} %{TimeS} %{zoneminder.camera.id}[%{process.pid}].%{zoneminder.event.type}-zm_monitor.cpp/%{Discard-1} [%{zoneminder.camera.name}: images:%{zoneminder.camera.images} - Capturing at %{zoneminder.camera.fps} fps, capturing bandwidth %{zoneminder.camera.bytes}bytes/sec]",
        "ignore_failure": true,
        "description": "zoneminder-c FPS & Bytes",
        "ignore_missing": true
      }
    },
    {
      "dissect": {
        "field": "message",
        "pattern": "%{Date} %{TimeS} %{zoneminder.camera.id}[%{process.pid}].%{zoneminder.event.type}-zm_monitor.cpp/%{Discard-1} [Buffer overrun at index %{zoneminder.camera.buffer_overrun.index}, image %{zoneminder.camera.buffer_overrun.image}, slow down capture, speed up analysis or increase ring buffer size]",
        "ignore_failure": true,
        "description": "zoneminder-c Buffer Overrun",
        "ignore_missing": true
      }
    },
    {
      "dissect": {
        "field": "message",
        "pattern": "%{Date} %{TimeS} %{zoneminder.camera.id}[%{process.pid}].%{zoneminder.event.type}-zm_monitor.cpp/%{Discard-1} [Last image read from shared memory %{zoneminder.camera.buffer_overrun.seconds} seconds ago, zma may have gone away]",
        "ignore_failure": true,
        "description": "zoneminder-c Last Image Gone Away",
        "ignore_missing": true
      }
    },
    {
      "dissect": {
        "field": "message",
        "pattern": "%{Date} %{TimeS} %{zoneminder.camera.id}[%{process.pid}].%{zoneminder.event.type}-zm_ffmpeg_camera.cpp/%{Discard-1} [Monitor dimensions are %{zoneminder.monitor.setting} but camera is sending %{zoneminder.camera.setting}]",
        "ignore_failure": true,
        "description": "zoneminder-c Monitor Dimensions",
        "ignore_missing": true
      }
    },
    {
      "gsub": {
        "field": "zoneminder.event.type",
        "pattern": "INF",
        "replacement": "info",
        "description": "zoneminder-ALL INF to info",
        "ignore_missing": true
      }
    },
    {
      "gsub": {
        "field": "zoneminder.event.type",
        "pattern": "DBG",
        "replacement": "info",
        "description": "zoneminder-ALL DBG to info",
        "ignore_missing": true
      }
    },
    {
      "gsub": {
        "field": "zoneminder.event.type",
        "pattern": "WAR",
        "replacement": "error",
        "description": "zoneminder-ALL WAR to error",
        "ignore_missing": true
      }
    },
    {
      "gsub": {
        "field": "zoneminder.event.type",
        "pattern": "ERR",
        "replacement": "error",
        "description": "zoneminder-ALL ERR to error",
        "ignore_missing": true
      }
    },
    {
      "set": {
        "field": "zoneminder.event.created",
        "value": "{{Date}} {{TimeS}}",
        "description": "zoneminder-ALL Set zoneminder.event.created"
      }
    },
    {
      "dissect": {
        "field": "TimeS",
        "pattern": "%{Time}.%{Discard-3}",
        "description": "zoneminder-ALL TimeS to Time",
        "ignore_missing": true
      }
    },
    {
      "remove": {
        "field": [
          "Discard-1",
          "Discard-2",
          "Discard-3",
          "Discard-4",
          "Discard-5",
          "Discard-6",
          "Discard-7",
          "TimeS"
        ],
        "description": "zoneminder-ALL Dump the old",
        "ignore_missing": true
      }
    }
  ]
}