Ingest pipeline for Apache logs with GeoIP

pipeline.json

{
  "description": "Ingest pipeline created by text structure finder",
  "processors": [
    {
      "grok": {
        "field": "message",
        "patterns": [
          "\\[%{HTTPDATE:timestamp}\\] .*?%{GREEDYDATA:domain_name}:%{NUMBER:port} .*?%{IP:ipaddress}.*? .*? .*? .*?%{QUOTEDSTRING:request} %{INT:status_code} %{INT:size} %{QUOTEDSTRING:referrer} %{QUOTEDSTRING:user_agent}"
        ],
        "ecs_compatibility": "v1"
      }
    },
    {
      "date": {
        "field": "timestamp",
        "formats": [
          "dd/MMM/yyyy:HH:mm:ss XX"
        ]
      }
    },
    {
      "convert": {
        "field": "port",
        "type": "long",
        "ignore_missing": true
      }
    },
    {
      "convert": {
        "field": "size",
        "type": "long",
        "ignore_missing": true
      }
    },
    {
      "convert": {
        "field": "status_code",
        "type": "long",
        "ignore_missing": true
      }
    },
    {
      "remove": {
        "field": "timestamp"
      }
    },
    {
      "geoip": {
        "field": "ipaddress",
        "target_field": "geolocation"
      }
    }
  ]
}