voici le document : [
{
"_id": "H4rpLY4BeAv5Qtd8-WOn",
"_index": ".ds-logs-sfs.reverseproxy-qualif-2024.03.01-000001",
"_source": {
"container": {
"image": {
"name": "apps-docker.nexus-ein.com.intraorange/sfs/systeme/traefik:G01R02C02"
},
"name": "ansible_reverse-proxy_1",
"id": "259a1eb760a43e2fd50279a3408d7728198e6a8774ec485262f83c7dff5a6667"
},
"elasticaas": {
"index": "caas-cnp-sfs-qualif",
"source": "sfs"
},
"agent": {
"hostname": "626d1d058b70",
"name": "626d1d058b70",
"id": "4192173d-e312-4f0c-97d8-8944685b07a6",
"type": "filebeat",
"ephemeral_id": "89c5d159-9c8d-418b-be0e-2edbdf49c322",
"version": "7.17.12"
},
"log": {
"file": {
"path": "/var/lib/docker/containers/259a1eb760a43e2fd50279a3408d7728198e6a8774ec485262f83c7dff5a6667/259a1eb760a43e2fd50279a3408d7728198e6a8774ec485262f83c7dff5a6667-json.log"
},
"offset": 2129053
},
"error": {
"message": "TypeError: Object has no member 'Has' at process (inline.js:2:16(5))"
},
"message": "193.253.10.133 - - [11/Mar/2024:14:28:09 +0000] "POST /indigo/api/productOrdering/v2/requestTrackingProductOrders?offset=0&limit=10&sort=-orderDate&filter.offerName=BVPN&customerRootStatus=waiting&search=3-00617864 HTTP/1.1" 200 2 "-" "-" 1049723 "uat-rpxd-pex-inter-G03R04C07@docker" "http://10.0.0.4:80\" 697ms",
"tags": [
"_js_exception",
"beats_input_codec_plain_applied"
],
"docker": {
"container": {
"labels": {
"com_docker_compose_config-hash": "ca4d4451aba94dd71f9069bceb57da005f028ec0df93b778646646170a7d1a71",
"org_opencontainers_image_title": "sfs-fe/sfs/images/traefik",
"org_opencontainers_image_description": "A modern reverse-proxy",
"com_docker_compose_oneoff": "False",
"com_docker_compose_project_config_files": "/home/ansible/traefik-compose.yml",
"com_docker_compose_project": "ansible",
"org_opencontainers_image_created": "2023-10-23T15:03:32Z",
"org_opencontainers_image_source": "https://gitlab.tech.orange/sfs-fe/sfs/images/traefik",
"version": "1.1.8",
"org_opencontainers_image_vendor": "Traefik Labs",
"org_opencontainers_image_version": "v2.10.5",
"org_opencontainers_image_revision": "013a6b11b87242dd3743c0e362fcda2575975cad",
"org_opencontainers_image_documentation": "https://docs.traefik.io",
"com_docker_compose_service": "reverse-proxy",
"org_opencontainers_image_url": "https://gitlab.tech.orange/sfs-fe/sfs/images/traefik",
"name": "ImageTraefik",
"com_docker_compose_container-number": "1",
"co_elastic_logs/enabled": "true",
"com_docker_compose_version": "1.26.2",
"org_opencontainers_image_ref_name": "G01R02C02",
"com_docker_compose_project_working_dir": "/home/ansible"
}
}
},
"sfs_size": null,
"input": {
"type": "container"
},
"@timestamp": "2024-03-11T14:28:10.646Z",
"ecs": {
"version": "1.12.0"
},
"stream": "stdout",
"data_stream": {
"namespace": "qualif",
"type": "logs",
"dataset": "sfs.reverseproxy"
},
"tmp": "tmp",
"@version": "1",
"host": {
"name": "626d1d058b70"
},
"event": {
"agent_id_status": "auth_metadata_missing",
"ingested": "2024-03-11T14:28:12Z",
"original": "193.253.10.133 - - [11/Mar/2024:14:28:09 +0000] "POST /indigo/api/productOrdering/v2/requestTrackingProductOrders?offset=0&limit=10&sort=-orderDate&filter.offerName=BVPN&customerRootStatus=waiting&search=3-00617864 HTTP/1.1" 200 2 "-" "-" 1049723 "uat-rpxd-pex-inter-G03R04C07@docker" "http://10.0.0.4:80\" 697ms"
}
}
}
]

{
"docs": [
{
"error": {
"root_cause": [
{
"type": "illegal_argument_exception",
"reason": "Provided Grok expressions do not match field value: [193.253.10.133 - - [11/Mar/2024:14:28:09 +0000] "POST /indigo/api/productOrdering/v2/requestTrackingProductOrders?offset=0&limit=10&sort=-orderDate&filter.offerName=BVPN&customerRootStatus=waiting&search=3-00617864 HTTP/1.1" 200 2 "-" "-" 1049723 "uat-rpxd-pex-inter-G03R04C07@docker" "http://10.0.0.4:80\" 697ms]"
}
],
"type": "illegal_argument_exception",
"reason": "Provided Grok expressions do not match field value: [193.253.10.133 - - [11/Mar/2024:14:28:09 +0000] "POST /indigo/api/productOrdering/v2/requestTrackingProductOrders?offset=0&limit=10&sort=-orderDate&filter.offerName=BVPN&customerRootStatus=waiting&search=3-00617864 HTTP/1.1" 200 2 "-" "-" 1049723 "uat-rpxd-pex-inter-G03R04C07@docker" "http://10.0.0.4:80\" 697ms]"
}
}
]
}


voici mon pipeline :

{
    "description": "Custom reverse proxy processing pipeline",
    "processors": [
      {
        "remove": {
          "field": [
            "agent.type",
            "agent.ephemeral_id",
            "agent.hostname",
            "agent.id",
            "agent.name",
            "agent.version"
          ],
          "description": "Remove Filebeat Info"
        }
      },
      {
        "dissect": {
          "field": "event.original",
          "pattern": "\"REVERSE-PROXY-%{event.type}-%{service.id}-%{+service.id}-%{+service.id}-%{+service.id}-%{+service.id}-%{service.version}\"%{message}",
          "append_separator": "-"
        }
      },
      {
        "dissect": {
          "field": "message",
          "pattern": " %{host.ip} - - [%{tmp.timestamp}] \"%{http.request.method} %{url.path} HTTP/%{http.version}\" %{http.response.status_code} %{http.response.bytes} \"%{http.request.referrer}\" \"%{user.agent}\" %{tmp.duration_ms} \"%{service.id}\" \"%{url.original}\" %{event.duration}ms"
        }
      },
      {
        "date": {
          "field": "tmp.timestamp",
          "formats": [
            "dd/MMM/yyyy:HH:mm:ss Z"
          ],
          "target_field": "@timestamp"
        }
      },
      {
        "script": {
          "source": "ctx.event.duration = Integer.parseInt(ctx?.event?.duration)"
        }
      },
      {
        "remove": {
          "field": [
            "tmp",
            "http.response.bytes"
          ],
          "if": "ctx?.http?.response?.bytes == '-'"
        }
      },
      {
        "set": {
          "field": "error.message",
          "value": "{{_ingest.pipeline}}: processors {{_ingest.on_failure_processor_type}} in pipeline {{_ingest.on_failure_pipeline}} failed with message {{_ingest.on_failure_message}}"
        }
      }
    ]
  }