[snapshot] Update "logstash" package to version 2.1.0-preview1

packages/logstash/2.1.0-preview1/LICENSE.txt

@@ -0,0 +1,93 @@
+Elastic License 2.0
+
+URL: https://www.elastic.co/licensing/elastic-license
+
+## Acceptance
+
+By using the software, you agree to all of the terms and conditions below.
+
+## Copyright License
+
+The licensor grants you a non-exclusive, royalty-free, worldwide,
+non-sublicensable, non-transferable license to use, copy, distribute, make
+available, and prepare derivative works of the software, in each case subject to
+the limitations and conditions below.
+
+## Limitations
+
+You may not provide the software to third parties as a hosted or managed
+service, where the service provides users with access to any substantial set of
+the features or functionality of the software.
+
+You may not move, change, disable, or circumvent the license key functionality
+in the software, and you may not remove or obscure any functionality in the
+software that is protected by the license key.
+
+You may not alter, remove, or obscure any licensing, copyright, or other notices
+of the licensor in the software. Any use of the licensor’s trademarks is subject
+to applicable law.
+
+## Patents
+
+The licensor grants you a license, under any patent claims the licensor can
+license, or becomes able to license, to make, have made, use, sell, offer for
+sale, import and have imported the software, in each case subject to the
+limitations and conditions in this license. This license does not cover any
+patent claims that you cause to be infringed by modifications or additions to
+the software. If you or your company make any written claim that the software
+infringes or contributes to infringement of any patent, your patent license for
+the software granted under these terms ends immediately. If your company makes
+such a claim, your patent license ends immediately for work on behalf of your
+company.
+
+## Notices
+
+You must ensure that anyone who gets a copy of any part of the software from you
+also gets a copy of these terms.
+
+If you modify the software, you must include in any modified copies of the
+software prominent notices stating that you have modified the software.
+
+## No Other Rights
+
+These terms do not imply any licenses other than those expressly granted in
+these terms.
+
+## Termination
+
+If you use the software in violation of these terms, such use is not licensed,
+and your licenses will automatically terminate. If the licensor provides you
+with a notice of your violation, and you cease all violation of this license no
+later than 30 days after you receive that notice, your licenses will be
+reinstated retroactively. However, if you violate these terms after such
+reinstatement, any additional violation of these terms will cause your licenses
+to terminate automatically and permanently.
+
+## No Liability
+
+*As far as the law allows, the software comes as is, without any warranty or
+condition, and the licensor will not be liable to you for any damages arising
+out of these terms or the use or nature of the software, under any kind of
+legal claim.*
+
+## Definitions
+
+The **licensor** is the entity offering these terms, and the **software** is the
+software the licensor makes available under these terms, including any portion
+of it.
+
+**you** refers to the individual or entity agreeing to these terms.
+
+**your company** is any legal entity, sole proprietorship, or other kind of
+organization that you work for, plus all organizations that have control over,
+are under the control of, or are under common control with that
+organization. **control** means ownership of substantially all the assets of an
+entity, or the power to direct its management and policies by vote, contract, or
+otherwise. Control can be direct or indirect.
+
+**your licenses** are all the licenses granted to you for the software under
+these terms.
+
+**use** means anything you do with the software requiring one of your licenses.
+
+**trademark** means trademarks, service marks, and similar rights.

packages/logstash/2.1.0-preview1/changelog.yml

@@ -0,0 +1,29 @@
+# newer versions go on top
+- version: "2.1.0-preview1"
+  changes:
+    - description: Suffix `stack_monitoring` to the datasets
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/4018
+    - description: Align metrics mappings with metricbeat
+      type: bugfix
+      link: https://github.com/elastic/integrations/pull/3993
+- version: "1.1.0"
+  changes:
+    - description: Make experimental package stop breaking stack version ^8.0.0 by fixing compatible version range
+      type: bugfix
+      link: https://github.com/elastic/integrations/pull/2697
+- version: "1.0.2"
+  changes:
+    - description: Revert package to experimental
+      type: bugfix
+      link: https://github.com/elastic/integrations/pull/2127
+- version: "1.0.1"
+  changes:
+    - description: Uniform with guidelines
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/2060
+- version: 1.0.0
+  changes:
+    - description: initial release
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/1555

packages/logstash/2.1.0-preview1/data_stream/log/agent/stream/log.yml.hbs

@@ -0,0 +1,16 @@
+paths:
+{{#each paths as |path i|}}
+ - {{path}}
+{{/each}}
+exclude_files: [".gz$"]
+multiline:
+  pattern: ^((\[[0-9]{4}-[0-9]{2}-[0-9]{2}[^\]]+\])|({.+}))
+  negate: true
+  match: after
+processors:
+# Locale for time zone is only needed in non-json logs
+- add_locale.when.not.regexp.message: "^{"
+- add_fields:
+    target: ''
+    fields:
+      ecs.version: 1.10.0

packages/logstash/2.1.0-preview1/data_stream/log/elasticsearch/ingest_pipeline/default.yml

@@ -0,0 +1,28 @@
+---
+description: Pipeline for parsing logstash node logs
+processors:
+- set:
+    field: event.ingested
+    value: '{{_ingest.timestamp}}'
+- grok:
+    field: message
+    patterns:
+      - ^%{CHAR:first_char}
+    pattern_definitions:
+      CHAR: .
+- pipeline:
+    if: ctx.first_char != '{'
+    name: '{{ IngestPipeline "pipeline-plaintext" }}'
+- pipeline:
+    if: ctx.first_char == '{'
+    name: '{{ IngestPipeline "pipeline-json" }}'
+- set:
+    copy_from: "@timestamp"
+    field: event.created
+- remove:
+    field:
+      - first_char
+on_failure:
+  - set:
+      field: error.message
+      value: '{{ _ingest.on_failure_message }}'

packages/logstash/2.1.0-preview1/data_stream/log/elasticsearch/ingest_pipeline/pipeline-json.yml

@@ -0,0 +1,58 @@
+---
+description: Pipeline for parsing logstash logs
+on_failure:
+- set:
+    field: error.message
+    value: '{{ _ingest.on_failure_message }}'
+processors:
+- json:
+    field: message
+    target_field: logstash.log
+- convert:
+    field: logstash.log.timeMillis
+    type: string
+- date:
+    field: logstash.log.timeMillis
+    formats:
+    - UNIX_MS
+    target_field: '@timestamp'
+- rename:
+    field: logstash.log.loggerName
+    target_field: logstash.log.module
+- remove:
+    field:
+    - message
+    - logstash.log.timeMillis
+- rename:
+    field: logstash.log.logEvent.message
+    target_field: message
+- rename:
+    field: logstash.log.logEvent
+    target_field: logstash.log.log_event
+- rename:
+    field: logstash.log.level
+    target_field: log.level
+- script:
+    description: Convert logstash.log.log_event.action elements to string.
+    if: ctx?.logstash?.log?.log_event?.action instanceof List
+    lang: painless
+    source: |
+      def items = [];
+      ctx.logstash.log.log_event.action.forEach(v -> {
+          items.add(v.toString());
+      });
+      ctx.logstash.log.log_event.action = items;
+- set:
+    field: event.kind
+    value: event
+- script:
+    lang: painless
+    source: >-
+      def errorLevels = ["ERROR", "FATAL"];
+      if (ctx?.log?.level != null) {
+        if (errorLevels.contains(ctx.log.level)) {
+          ctx.event.type = "error";
+        } else {
+          ctx.event.type = "info";
+        }
+      }

packages/logstash/2.1.0-preview1/data_stream/log/elasticsearch/ingest_pipeline/pipeline-plaintext.yml

@@ -0,0 +1,57 @@
+---
+description: Pipeline for parsing logstash logs in the plain format
+on_failure:
+- set:
+    field: error.message
+    value: '{{ _ingest.on_failure_message }}'
+processors:
+- grok:
+    field: message
+    pattern_definitions:
+      LOGSTASH_CLASS_MODULE: '[\w\.]+'
+      LOGSTASH_LOGLEVEL: INFO|ERROR|DEBUG|FATAL|WARN|TRACE
+      GREEDYMULTILINE: |-
+        (.|
+        )*
+    patterns:
+    - \[%{TIMESTAMP_ISO8601:logstash.log.timestamp}\]\[%{LOGSTASH_LOGLEVEL:log.level}\s?\]\[%{LOGSTASH_CLASS_MODULE:logstash.log.module}\s*\]\[%{NOTSPACE:logstash.log.pipeline_id}\]
+      %{GREEDYMULTILINE:message}
+    - \[%{TIMESTAMP_ISO8601:logstash.log.timestamp}\]\[%{LOGSTASH_LOGLEVEL:log.level}\s?\]\[%{LOGSTASH_CLASS_MODULE:logstash.log.module}\s*\]
+      %{GREEDYMULTILINE:message}
+- date:
+    if: ctx.event.timezone == null
+    field: logstash.log.timestamp
+    target_field: '@timestamp'
+    formats:
+    - yyyy-MM-dd'T'HH:mm:ss,SSS
+    on_failure:
+    - append:
+        field: error.message
+        value: '{{ _ingest.on_failure_message }}'
+- date:
+    if: ctx.event.timezone != null
+    field: logstash.log.timestamp
+    target_field: '@timestamp'
+    formats:
+    - yyyy-MM-dd'T'HH:mm:ss,SSS
+    timezone: '{{ event.timezone }}'
+    on_failure:
+    - append:
+        field: error.message
+        value: '{{ _ingest.on_failure_message }}'
+- remove:
+    field: logstash.log.timestamp
+- set:
+    field: event.kind
+    value: event
+- script:
+    lang: painless
+    source: >-
+      def errorLevels = ["ERROR", "FATAL"];
+      if (ctx?.log?.level != null) {
+        if (errorLevels.contains(ctx.log.level)) {
+          ctx.event.type = "error";
+        } else {
+          ctx.event.type = "info";
+        }
+      }

packages/logstash/2.1.0-preview1/data_stream/log/fields/base-fields.yml

@@ -0,0 +1,9 @@
+- name: data_stream.type
+  type: constant_keyword
+  description: Data stream type.
+- name: data_stream.dataset
+  type: constant_keyword
+  description: Data stream dataset.
+- name: data_stream.namespace
+  type: constant_keyword
+  description: Data stream namespace.

packages/logstash/2.1.0-preview1/data_stream/log/fields/ecs.yml

@@ -0,0 +1,29 @@
+- description: |-
+    Date/time when the event originated.
+    This is the date/time extracted from the event, typically representing when the event was generated by the source.
+    If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.
+    Required field for all events.
+  name: '@timestamp'
+  type: date
+- description: |-
+    For log events the message field contains the log message, optimized for viewing in a log viewer.
+    For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.
+    If multiple messages exist, they can be combined into one message.
+  name: message
+  type: match_only_text
+- description: |-
+    Original log level of the log event.
+    If the source of the event provides a log level or textual severity, this is the one that goes in `log.level`. If your source doesn't specify one, you may put your event transport's severity here (e.g. Syslog severity).
+    Some examples are `warn`, `err`, `i`, `informational`.
+  name: log.level
+  type: keyword
+- description: |-
+    ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.
+    When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.
+  name: ecs.version
+  type: keyword
+- description: |-
+    Full path to the log file this event came from, including the file name. It should include the drive letter, when appropriate.
+    If the event wasn't read from a log file, do not populate this field.
+  name: log.file.path
+  type: keyword

packages/logstash/2.1.0-preview1/data_stream/log/fields/fields.yml

@@ -0,0 +1,25 @@
+- name: input.type
+  type: keyword
+- name: log.offset
+  type: long
+- name: logstash.log
+  title: Logstash
+  type: group
+  fields:
+    - name: module
+      type: keyword
+      description: |
+        The module or class where the event originate.
+    - name: thread
+      type: keyword
+      description: |
+        Information about the running thread where the log originate.
+      multi_fields:
+        - name: text
+          type: text
+    - name: pipeline_id
+      type: keyword
+    - name: log_event
+      type: flattened
+      description: |
+        key and value debugging information.

packages/logstash/2.1.0-preview1/data_stream/log/manifest.yml

@@ -0,0 +1,17 @@
+type: logs
+title: Logstash logs
+release: experimental
+streams:
+  - input: logfile
+    vars:
+      - name: paths
+        type: text
+        title: Paths
+        multi: true
+        required: true
+        show_user: true
+        default:
+          - /var/log/logstash/logstash-json*.log
+    template_path: log.yml.hbs
+    title: Logstash logs
+    description: Collect Logstash logs from standard files