Mar 11, 2024 @ 10:47:45.429

- @timestamp, column 3, row 1
ERROR
 [Mon Mar 11 09:47:45 2024] [debug] proxy_util.c(2596): [client 10.0.0.2:58392] AH00947: connected /pex-inventory/ws/v2/user/?code=SCW0118006&codlng=0&perimeterid=115dcde1-6899-42b7-a859-a7882018a9ce to uat-rpwa-pex-inter.sfs-qualif.caas-cnp-apps-v2.com.intraorange:443, referer https://www.espace-client.exploit-ip-uat.orange-business.com/pex-inventory/gui/v1/?code=SCW0118006&codlng=0&perimeterid=115dcde1-6899-42b7-a859-a7882018a9ce&context=indigo2&offerId=NUMEROS_CONTACT_IP
logs-sfs.error@custom: processors dissect in pipeline logs-sfs.error@custom failed with message Unable to find match for dissect pattern: [%{timestamp}] [%{log_level}] %{filename}(%{linenumber}): [%{client_ip}] [%{ignored_message}] %{restOfLine} against source:  [Mon Mar 11 09:47:45 2024] [debug] proxy_util.c(2596): [client 10.0.0.2:58392] AH00947: connected /pex-inventory/ws/v2/user/?code=SCW0118006&codlng=0&perimeterid=115dcde1-6899-42b7-a859-a7882018a9ce to uat-rpwa-pex-inter.sfs-qualif.caas-cnp-apps-v2.com.intraorange:443, referer https://www.espace-client.exploit-ip-uat.orange-business.com/pex-inventory/gui/v1/?code=SCW0118006&codlng=0&perimeterid=115dcde1-6899-42b7-a859-a7882018a9ce&context=indigo2&offerId=NUMEROS_CONTACT_IP
Mar 11, 2024 @ 10:47:45.428
ERROR
 [Mon Mar 11 09:47:45 2024] [debug] ssl_engine_kernel.c(2069): [client 10.235.70.188:443] AH02041: Protocol: TLSv1.2, Cipher: ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)
logs-sfs.error@custom: processors dissect in pipeline logs-sfs.error@custom failed with message Unable to find match for dissect pattern: [%{timestamp}] [%{log_level}] %{filename}(%{linenumber}): [%{client_ip}] [%{ignored_message}] %{restOfLine} against source:  [Mon Mar 11 09:47:45 2024] [debug] ssl_engine_kernel.c(2069): [client 10.235.70.188:443] AH02041: Protocol: TLSv1.2, Cipher: ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)
Mar 11, 2024 @ 10:47:45.424
ERROR
 [Mon Mar 11 09:47:45 2024] [debug] ssl_engine_kernel.c(1584): [client 10.235.70.188:443] AH02275: Certificate Verification, depth 0, CRL checking mode: none (0) [subject: <PRESIDIO_ANONYMIZED_EMAIL_ADDRESS>,CN=*.sfs-qualif.caas-cnp-apps-v2.com.intraorange,OU=Orange Business Services,O=Orange,L=Paris,ST=Paris,C=FR / issuer: CN=Orange Internal G2 Server CA,OU=FR 89 380129866,O=Orange,C=FR / serial: 39E5400000BE3547743EEABB89BF15AD9365A9EA / notbefore: Apr  4 16:03:28 2023 GMT / notafter: Apr  4 16:03:28 2025 GMT]
logs-sfs.error@custom: processors dissect in pipeline logs-sfs.error@custom failed with message Unable to find match for dissect pattern: [%{timestamp}] [%{log_level}] %{filename}(%{linenumber}): [%{client_ip}] [%{ignored_message}] %{restOfLine} against source:  [Mon Mar 11 09:47:45 2024] [debug] ssl_engine_kernel.c(1584): [client 10.235.70.188:443] AH02275: Certificate Verification, depth 0, CRL checking mode: none (0) [subject: <PRESIDIO_ANONYMIZED_EMAIL_ADDRESS>,CN=*.sfs-qualif.caas-cnp-apps-v2.com.intraorange,OU=Orange Business Services,O=Orange,L=Paris,ST=Paris,C=FR / issuer: CN=Orange Internal G2 Server CA,OU=FR 89 380129866,O=Orange,C=FR / serial: 39E5400000BE3547743EEABB89BF15AD9365A9EA / notbefore: Apr  4 16:03:28 2023 GMT / notafter: Apr  4 16:03:28 2025 GMT]
Mar 11, 2024 @ 10:47:45.424
ERROR
 [Mon Mar 11 09:47:45 2024] [debug] ssl_engine_kernel.c(1584): [client 10.235.70.188:443] AH02275: Certificate Verification, depth 0, CRL checking mode: none (0) [subject: <PRESIDIO_ANONYMIZED_EMAIL_ADDRESS>,CN=*.sfs-qualif.caas-cnp-apps-v2.com.intraorange,OU=Orange Business Services,O=Orange,L=Paris,ST=Paris,C=FR / issuer: CN=Orange Internal G2 Server CA,OU=FR 89 380129866,O=Orange,C=FR / serial: 39E5400000BE3547743EEABB89BF15AD9365A9EA / notbefore: Apr  4 16:03:28 2023 GMT / notafter: Apr  4 16:03:28 2025 GMT]
logs-sfs.error@custom: processors dissect in pipeline logs-sfs.error@custom failed with message Unable to find match for dissect pattern: [%{timestamp}] [%{log_level}] %{filename}(%{linenumber}): [%{client_ip}] [%{ignored_message}] %{restOfLine} against source:  [Mon Mar 11 09:47:45 2024] [debug] ssl_engine_kernel.c(1584): [client 10.235.70.188:443] AH02275: Certificate Verification, depth 0, CRL checking mode: none (0) [subject: <PRESIDIO_ANONYMIZED_EMAIL_ADDRESS>,CN=*.sfs-qualif.caas-cnp-apps-v2.com.intraorange,OU=Orange Business Services,O=Orange,L=Paris,ST=Paris,C=FR / issuer: CN=Orange Internal G2 Server CA,OU=FR 89 380129866,O=Orange,C=FR / serial: 39E5400000BE3547743EEABB89BF15AD9365A9EA / notbefore: Apr  4 16:03:28 2023 GMT / notafter: Apr  4 16:03:28 2025 GMT]
Mar 11, 2024 @ 10:47:45.419
ERROR
 [Mon Mar 11 09:47:45 2024] [debug] mod_proxy.c(1265): [client 10.0.0.2:58392] AH01143: Running scheme https handler (attempt 0), referer https://www.espace-client.exploit-ip-uat.orange-business.com/pex-inventory/gui/v1/?code=SCW0118006&codlng=0&perimeterid=115dcde1-6899-42b7-a859-a7882018a9ce&context=indigo2&offerId=NUMEROS_CONTACT_IP
logs-sfs.error@custom: processors dissect in pipeline logs-sfs.error@custom failed with message Unable to find match for dissect pattern: [%{timestamp}] [%{log_level}] %{filename}(%{linenumber}): [%{client_ip}] [%{ignored_message}] %{restOfLine} against source:  [Mon Mar 11 09:47:45 2024] [debug] mod_proxy.c(1265): [client 10.0.0.2:58392] AH01143: Running scheme https handler (attempt 0), referer https://www.espace-client.exploit-ip-uat.orange-business.com/pex-inventory/gui/v1/?code=SCW0118006&codlng=0&perimeterid=115dcde1-6899-42b7-a859-a7882018a9ce&context=indigo2&offerId=NUMEROS_CONTACT_IP
Mar 11, 2024 @ 10:47:45.419
ERROR
 [Mon Mar 11 09:47:45 2024] [debug] proxy_util.c(2331): AH00942: HTTPS: has acquired connection for (*)
logs-sfs.error@custom: processors dissect in pipeline logs-sfs.error@custom failed with message Unable to find match for dissect pattern: [%{timestamp}] [%{log_level}] %{filename}(%{linenumber}): [%{client_ip}] [%{ignored_message}] %{restOfLine} against source:  [Mon Mar 11 09:47:45 2024] [debug] proxy_util.c(2331): AH00942: HTTPS: has acquired connection for (*)
Mar 11, 2024 @ 10:47:45.419
ERROR
 [Mon Mar 11 09:47:45 2024] [debug] proxy_util.c(2384): [client 10.0.0.2:58392] AH00944: connecting https://uat-rpwa-pex-inter.sfs-qualif.caas-cnp-apps-v2.com.intraorange/pex-inventory/ws/v2/user/?code=SCW0118006&codlng=0&perimeterid=115dcde1-6899-42b7-a859-a7882018a9ce to uat-rpwa-pex-inter.sfs-qualif.caas-cnp-apps-v2.com.intraorange:443, referer https://www.espace-client.exploit-ip-uat.orange-business.com/pex-inventory/gui/v1/?code=SCW0118006&codlng=0&perimeterid=115dcde1-6899-42b7-a859-a7882018a9ce&context=indigo2&offerId=NUMEROS_CONTACT_IP
logs-sfs.error@custom: processors dissect in pipeline logs-sfs.error@custom failed with message Unable to find match for dissect pattern: [%{timestamp}] [%{log_level}] %{filename}(%{linenumber}): [%{client_ip}] [%{ignored_message}] %{restOfLine} against source:  [Mon Mar 11 09:47:45 2024] [debug] proxy_util.c(2384): [client 10.0.0.2:58392] AH00944: connecting https://uat-rpwa-pex-inter.sfs-qualif.caas-cnp-apps-v2.com.intraorange/pex-inventory/ws/v2/user/?code=SCW0118006&codlng=0&perimeterid=115dcde1-6899-42b7-a859-a7882018a9ce to uat-rpwa-pex-inter.sfs-qualif.caas-cnp-apps-v2.com.intraorange:443, referer https://www.espace-client.exploit-ip-uat.orange-business.com/pex-inventory/gui/v1/?code=SCW0118006&codlng=0&perimeterid=115dcde1-6899-42b7-a859-a7882018a9ce&context=indigo2&offerId=NUMEROS_CONTACT_IP
Mar 11, 2024 @ 10:47:45.418
ERROR
 [Mon Mar 11 09:47:45 2024] [debug] proxy_util.c(3066): AH02824: HTTPS: connection established with 10.235.70.188:443 (*)
logs-sfs.error@custom: processors dissect in pipeline logs-sfs.error@custom failed with message Unable to find match for dissect pattern: [%{timestamp}] [%{log_level}] %{filename}(%{linenumber}): [%{client_ip}] [%{ignored_message}] %{restOfLine} against source:  [Mon Mar 11 09:47:45 2024] [debug] proxy_util.c(3066): AH02824: HTTPS: connection established with 10.235.70.188:443 (*)
Mar 11, 2024 @ 10:47:45.418
ERROR
 [Mon Mar 11 09:47:45 2024] [debug] proxy_util.c(3234): AH00962: HTTPS: connection complete to 10.235.70.188:443 (uat-rpwa-pex-inter.sfs-qualif.caas-cnp-apps-v2.com.intraorange)
logs-sfs.error@custom: processors dissect in pipeline logs-sfs.error@custom failed with message Unable to find match for dissect pattern: [%{timestamp}] [%{log_level}] %{filename}(%{linenumber}): [%{client_ip}] [%{ignored_message}] %{restOfLine} against source:  [Mon Mar 11 09:47:45 2024] [debug] proxy_util.c(3234): AH00962: HTTPS: connection complete to 10.235.70.188:443 (uat-rpwa-pex-inter.sfs-qualif.caas-cnp-apps-v2.com.intraorange)
Mar 11, 2024 @ 10:47:45.418
ERROR
 [Mon Mar 11 09:47:45 2024] [info] [client 10.235.70.188:443] AH01964: Connection to child 0 established (server SFS-RP:80)
logs-sfs.error@custom: processors dissect in pipeline logs-sfs.error@custom failed with message Unable to find match for dissect pattern: [%{timestamp}] [%{log_level}] %{filename}(%{linenumber}): [%{client_ip}] [%{ignored_message}] %{restOfLine} against source:  [Mon Mar 11 09:47:45 2024] [info] [client 10.235.70.188:443] AH01964: Connection to child 0 established (server SFS-RP:80)



ma pipeline : 
[
  {
    "dissect": {
      "field": "event.original",
      "pattern": "\"APACHE-%{event.type}-%{service.id}-%{+service.id}-%{+service.id}-%{+service.id}-%{+service.id}-%{service.version}\"%{message}"
    }
  },
  {
    "dissect": {
      "field": "message",
      "pattern": "[%{timestamp}] [%{log_level}] %{filename}(%{linenumber}): [%{client_ip}] [%{ignored_message}] %{restOfLine}"
    }
  },
  {
    "grok": {
      "field": "restOfLine",
      "patterns": [
        "\\[%{DATA:client_ip}\\] %{DATA:action} %{GREEDYDATA:additional_info}"
      ]
    }
  },
  {
    "grok": {
      "field": "additional_info",
      "patterns": [
        "to %{IP:destination_ip}:%{POSINT:destination_port}",
        "depth %{INT:ssl_depth}, CRL checking mode: %{DATA:crl_mode} \\[subject: %{GREEDYDATA:certificate_subject} / issuer: %{GREEDYDATA:certificate_issuer} / serial: %{DATA:certificate_serial} / notbefore: %{DATA:certificate_notbefore} / notafter: %{DATA:certificate_notafter}\\]",
        "Protocol: %{DATA:protocol}, Cipher: %{DATA:cipher} \\(%{NUMBER:bits}/%{NUMBER:bits_max} bits\\)"
      ]
    }
  },
  {
    "date": {
      "field": "timestamp",
      "target_field": "@timestamp",
      "formats": [
        "EEE MMM dd HH:mm:ss yyyy"
      ]
    }
  }
]
[
  {
    "set": {
      "field": "error.message",
      "value": "{{_ingest.pipeline}}: processors {{_ingest.on_failure_processor_type}} in pipeline {{_ingest.on_failure_pipeline}} failed with message {{_ingest.on_failure_message}}"
    }
  }
]