From 708ced99aa4026557114af8f2aec632005babfca Mon Sep 17 00:00:00 2001
From: lgromero <lgromero@qindel.com>
Date: Thu, 24 Jul 2025 15:23:21 +0200
Subject: [PATCH] refs #2417 adds filebeat opengnsys pipeline

---
 etc/opensearch/pipelines.json | 32 ++++++++++++++++++++++++++++++++
 1 file changed, 32 insertions(+)

diff --git a/etc/opensearch/pipelines.json b/etc/opensearch/pipelines.json
index 9060c22..380674b 100644
--- a/etc/opensearch/pipelines.json
+++ b/etc/opensearch/pipelines.json
@@ -590,6 +590,38 @@
       }
     ]
   },
+  "filebeat_opengnsys_pipeline" : {
+    "description": "Parsea message y extrae JSON interno de data",
+    "processors": [
+      {
+        "set": {
+          "field": "message_raw",
+          "value": "{{message}}"
+        }
+      },
+      {
+        "json": {
+          "field": "message",
+          "target_field": "message_decoded",
+          "ignore_failure": true
+        }
+      },
+      {
+        "grok": {
+          "field": "message_decoded.message",
+          "patterns": ["data: %{GREEDYDATA:data_json}"],
+          "ignore_failure": true
+        }
+      },
+      {
+        "json": {
+          "field": "data_json",
+          "target_field": "data_decoded",
+          "ignore_failure": true
+        }
+      }
+    ]
+  },
   "copy-message-pipeline" : {
     "description" : "Pipeline que copia el campo message a message_raw",
     "processors" : [