ma pipeline sur elastic : 

[
  {
    "dissect": {
      "field": "event.original",
      "pattern": "\"APACHE-%{event.type}-%{service.id}-%{+service.id}-%{+service.id}-%{+service.id}-%{+service.id}-%{service.version}\"%{message}"
    }
  },
  {
    "dissect": {
      "field": "message",
      "pattern": "[%{timestamp}] [%{log_level}] %{restOfLine}"
    }
  },
  {
    "grok": {
      "field": "restOfLine",
      "patterns": [
        "\\[%{DATA:client_ip}\\] %{DATA:action} %{GREEDYDATA:additional_info}"
      ]
    }
  },
  {
    "grok": {
      "field": "additional_info",
      "patterns": [
        "to %{IP:destination_ip}:%{POSINT:destination_port}",
        "depth %{INT:ssl_depth}, CRL checking mode: %{DATA:crl_mode} \\[subject: %{GREEDYDATA:certificate_subject} / issuer: %{GREEDYDATA:certificate_issuer} / serial: %{DATA:certificate_serial} / notbefore: %{DATA:certificate_notbefore} / notafter: %{DATA:certificate_notafter}\\]",
        "Protocol: %{DATA:protocol}, Cipher: %{DATA:cipher} \\(%{NUMBER:bits}/%{NUMBER:bits_max} bits\\)"
      ]
    }
  },
  {
    "date": {
      "field": "timestamp",
      "target_field": "@timestamp",
      "formats": [
        "EEE MMM dd HH:mm:ss yyyy"
      ]
    }
  }
]

[
  {
    "set": {
      "field": "error.message",
      "value": "{{_ingest.pipeline}}: processors {{_ingest.on_failure_processor_type}} in pipeline {{_ingest.on_failure_pipeline}} failed with message {{_ingest.on_failure_message}}"
    }
  }
]

non ca ne marche pas voici de sexemples : Mar 11, 2024 @ 10:42:57.610
ERROR
 [Mon Mar 11 09:42:57 2024] [debug] ssl_engine_kernel.c(2069): [client 10.235.70.188:443] AH02041: Protocol: TLSv1.2, Cipher: ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)
logs-sfs.error@custom: processors dissect in pipeline logs-sfs.error@custom failed with message Unable to find match for dissect pattern: [%{timestamp}] [%{log_level}] %{restOfLine} against source:  [Mon Mar 11 09:42:57 2024] [debug] ssl_engine_kernel.c(2069): [client 10.235.70.188:443] AH02041: Protocol: TLSv1.2, Cipher: ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)
Mar 11, 2024 @ 10:42:57.607
ERROR
 [Mon Mar 11 09:42:57 2024] [debug] ssl_engine_kernel.c(1584): [client 10.235.70.188:443] AH02275: Certificate Verification, depth 0, CRL checking mode: none (0) [subject: <PRESIDIO_ANONYMIZED_EMAIL_ADDRESS>,CN=*.sfs-qualif.caas-cnp-apps-v2.com.intraorange,OU=Orange Business Services,O=Orange,L=Paris,ST=Paris,C=FR / issuer: CN=Orange Internal G2 Server CA,OU=FR 89 380129866,O=Orange,C=FR / serial: 39E5400000BE3547743EEABB89BF15AD9365A9EA / notbefore: Apr  4 16:03:28 2023 GMT / notafter: Apr  4 16:03:28 2025 GMT]
logs-sfs.error@custom: processors dissect in pipeline logs-sfs.error@custom failed with message Unable to find match for dissect pattern: [%{timestamp}] [%{log_level}] %{restOfLine} against source:  [Mon Mar 11 09:42:57 2024] [debug] ssl_engine_kernel.c(1584): [client 10.235.70.188:443] AH02275: Certificate Verification, depth 0, CRL checking mode: none (0) [subject: <PRESIDIO_ANONYMIZED_EMAIL_ADDRESS>,CN=*.sfs-qualif.caas-cnp-apps-v2.com.intraorange,OU=Orange Business Services,O=Orange,L=Paris,ST=Paris,C=FR / issuer: CN=Orange Internal G2 Server CA,OU=FR 89 380129866,O=Orange,C=FR / serial: 39E5400000BE3547743EEABB89BF15AD9365A9EA / notbefore: Apr  4 16:03:28 2023 GMT / notafter: Apr  4 16:03:28 2025 GMT]
Mar 11, 2024 @ 10:42:57.607
ERROR
 [Mon Mar 11 09:42:57 2024] [debug] ssl_engine_kernel.c(1584): [client 10.235.70.188:443] AH02275: Certificate Verification, depth 0, CRL checking mode: none (0) [subject: <PRESIDIO_ANONYMIZED_EMAIL_ADDRESS>,CN=*.sfs-qualif.caas-cnp-apps-v2.com.intraorange,OU=Orange Business Services,O=Orange,L=Paris,ST=Paris,C=FR / issuer: CN=Orange Internal G2 Server CA,OU=FR 89 380129866,O=Orange,C=FR / serial: 39E5400000BE3547743EEABB89BF15AD9365A9EA / notbefore: Apr  4 16:03:28 2023 GMT / notafter: Apr  4 16:03:28 2025 GMT]
logs-sfs.error@custom: processors dissect in pipeline logs-sfs.error@custom failed with message Unable to find match for dissect pattern: [%{timestamp}] [%{log_level}] %{restOfLine} against source:  [Mon Mar 11 09:42:57 2024] [debug] ssl_engine_kernel.c(1584): [client 10.235.70.188:443] AH02275: Certificate Verification, depth 0, CRL checking mode: none (0) [subject: <PRESIDIO_ANONYMIZED_EMAIL_ADDRESS>,CN=*.sfs-qualif.caas-cnp-apps-v2.com.intraorange,OU=Orange Business Services,O=Orange,L=Paris,ST=Paris,C=FR / issuer: CN=Orange Internal G2 Server CA,OU=FR 89 380129866,O=Orange,C=FR / serial: 39E5400000BE3547743EEABB89BF15AD9365A9EA / notbefore: Apr  4 16:03:28 2023 GMT / notafter: Apr  4 16:03:28 2025 GMT]

- error.message, column 6, row 22
Mar 11, 2024 @ 10:42:57.607
ERROR
 [Mon Mar 11 09:42:57 2024] [debug] ssl_engine_kernel.c(1584): [client 10.235.70.188:443] AH02275: Certificate Verification, depth 0, CRL checking mode: none (0) [subject: <PRESIDIO_ANONYMIZED_EMAIL_ADDRESS>,CN=*.sfs-qualif.caas-cnp-apps-v2.com.intraorange,OU=Orange Business Services,O=Orange,L=Paris,ST=Paris,C=FR / issuer: CN=Orange Internal G2 Server CA,OU=FR 89 380129866,O=Orange,C=FR / serial: 39E5400000BE3547743EEABB89BF15AD9365A9EA / notbefore: Apr  4 16:03:28 2023 GMT / notafter: Apr  4 16:03:28 2025 GMT]
logs-sfs.error@custom: processors dissect in pipeline logs-sfs.error@custom failed with message Unable to find match for