OR
 [Mon Mar 11 10:10:23 2024] [debug] proxy_util.c(3234): AH00962: HTTPS: connection complete to 10.235.70.188:443 (uat-rpwa-mss-mss.sfs-qualif.caas-cnp-apps-v2.com.intraorange)

- message, column 4, row 12
logs-sfs.error@custom: processors dissect in pipeline logs-sfs.error@custom failed with message Unable to find match for dissect pattern: %{logdate}] [%{log_level}] %{filename}(%{linenumber}): [%{client_ipwrapper}]%{message} against source:  [Mon Mar 11 10:10:23 2024] [debug] proxy_util.c(3234): AH00962: HTTPS: connection complete to 10.235.70.188:443 (uat-rpwa-mss-mss.sfs-qualif.caas-cnp-apps-v2.com.intraorange)
 - 
Mar 11, 2024 @ 11:10:23.324
ERROR
 [Mon Mar 11 10:10:23 2024] [info] [client 10.235.70.188:443] AH01964: Connection to child 0 established (server SFS-RP:80)
logs-sfs.error@custom: processors dissect in pipeline logs-sfs.error@custom failed with message Unable to find match for dissect pattern: %{logdate}] [%{log_level}] %{filename}(%{linenumber}): [%{client_ipwrapper}]%{message} against source:  [Mon Mar 11 10:10:23 2024] [info] [client 10.235.70.188:443] AH01964: Connection to child 0 established (server SFS-RP:80)
 - 
Mar 11, 2024 @ 11:10:23.324
ERROR
 [Mon Mar 11 10:10:23 2024] [debug] proxy_util.c(3066): AH02824: HTTPS: connection established with 10.235.70.188:443 (*)
logs-sfs.error@custom: processors dissect in pipeline logs-sfs.error@custom failed with message Unable to find match for dissect pattern: %{logdate}] [%{log_level}] %{filename}(%{linenumber}): [%{client_ipwrapper}]%{message} against source:  [Mon Mar 11 10:10:23 2024] [debug] proxy_util.c(3066): AH02824: HTTPS: connection established with 10.235.70.188:443 (*)
 - 
Mar 11, 2024 @ 11:10:23.323
ERROR
 [Mon Mar 11 10:10:23 2024] [debug] proxy_util.c(3234): AH00962: HTTPS: connection complete to 10.235.70.188:443 (uat-rpwa-mss-mss.sfs-qualif.caas-cnp-apps-v2.com.intraorange)
logs-sfs.error@custom: processors dissect in pipeline logs-sfs.error@custom failed with message Unable to find match for dissect pattern: %{logdate}] [%{log_level}] %{filename}(%{linenumber}): [%{client_ipwrapper}]%{message} against source:  [Mon Mar 11 10:10:23 2024] [debug] proxy_util.c(3234): AH00962: HTTPS: connection complete to 10.235.70.188:443 (uat-rpwa-mss-mss.sfs-qualif.caas-cnp-apps-v2.com.intraorange)
 - 
Mar 11, 2024 @ 11:10:23.323
ERROR
 [Mon Mar 11 10:10:23 2024] [debug] proxy_util.c(3066): AH02824: HTTPS: connection established with 10.235.70.188:443 (*)
logs-sfs.error@custom: processors dissect in pipeline logs-sfs.error@custom failed with message Unable to find match for dissect pattern: %{logdate}] [%{log_level}] %{filename}(%{linenumber}): [%{client_ipwrapper}]%{message} against source:  [Mon Mar 11 10:10:23 2024] [debug] proxy_util.c(3066): AH02824: HTTPS: connection established with 10.235.70.188:443 (*)
 - 
Mar 11, 2024 @ 11:10:23.324
ERROR
 AH02275: Certificate Verification, depth 0, CRL checking mode: none (0) [subject: <PRESIDIO_ANONYMIZED_EMAIL_ADDRESS>,CN=*.sfs-qualif.caas-cnp-apps-v2.com.intraorange,OU=Orange Business Services,O=Orange,L=Paris,ST=Paris,C=FR / issuer: CN=Orange Internal G2 Server CA,OU=FR 89 380129866,O=Orange,C=FR / serial: 39E5400000BE3547743EEABB89BF15AD9365A9EA / notbefore: Apr  4 16:03:28 2023 GMT / notafter: Apr  4 16:03:28 2025 GMT]
logs-sfs.error@custom: processors grok in pipeline logs-sfs.error@custom failed with message Provided Grok expressions do not match field value: [ AH02275: Certificate Verification, depth 0, CRL checking mode: none (0) [subject: <PRESIDIO_ANONYMIZED_EMAIL_ADDRESS>,CN=*.sfs-qualif.caas-cnp-apps-v2.com.intraorange,OU=Orange Business Services,O=Orange,L=Paris,ST=Paris,C=FR / issuer: CN=Orange Internal G2 Server CA,OU=FR 89 380129866,O=Orange,C=FR / serial: 39E5400000BE3547743EEABB89BF15AD9365A9EA / notbefore: Apr  4 16:03:28 2023 GMT / notafter: Apr  4 16:03:28 2025 GMT]]
 [Mon Mar 11 10:10:23 2024
Mar 11, 2024 @ 11:10:23.328
ERROR
 AH02275: Certificate Verification, depth 0, CRL checking mode: none (0) [subject: <PRESIDIO_ANONYMIZED_EMAIL_ADDRESS>,CN=*.sfs-qualif.caas-cnp-apps-v2.com.intraorange,OU=Orange Business Services,O=Orange,L=Paris,ST=Paris,C=FR / issuer: CN=Orange Internal G2 Server CA,OU=FR 89 380129866,O=Orange,C=FR / serial: 39E5400000BE3547743EEABB89BF15AD9365A9EA / notbefore: Apr  4 16:03:28 2023 GMT / notafter: Apr  4 16:03:28 2025 GMT]
logs-sfs.error@custom: processors grok in pipeline logs-sfs.error@custom failed with message Provided Grok expressions do not match field value: [ AH02275: Certificate Verification, depth 0, CRL checking mode: none (0) [subject: <PRESIDIO_ANONYMIZED_EMAIL_ADDRESS>,CN=*.sfs-qualif.caas-cnp-apps-v2.com.intraorange,OU=Orange Business Services,O=Orange,L=Paris,ST=Paris,C=FR / issuer: CN=Orange Internal G2 Server CA,OU=FR 89 380129866,O=Orange,C=FR / serial: 39E5400000BE3547743EEABB89BF15AD9365A9EA / notbefore: Apr  4 16:03:28 2023 GMT / notafter: Apr  4 16:03:28 2025 GMT]]
 [Mon Mar 11 10:10:23 2024
Mar 11, 2024 @ 11:10:23.328
ERROR
 AH02275: Certificate Verification, depth 0, CRL checking mode: none (0) [subject: <PRESIDIO_ANONYMIZED_EMAIL_ADDRESS>,CN=*.sfs-qualif.caas-cnp-apps-v2.com.intraorange,OU=Orange Business Services,O=Orange,L=Paris,ST=Paris,C=FR / issuer: CN=Orange Internal G2 Server CA,OU=FR 89 380129866,O=Orange,C=FR / serial: 39E5400000BE3547743EEABB89BF15AD9365A9EA / notbefore: Apr  4 16:03:28 2023 GMT / notafter: Apr  4 16:03:28 2025 GMT]
logs-sfs.error@custom: processors grok in pipeline logs-sfs.error@custom failed with message Provided Grok expressions do not match field value: [ AH02275: Certificate Verification, depth 0, CRL checking mode: none (0) [subject: <PRESIDIO_ANONYMIZED_EMAIL_ADDRESS>,CN=*.sfs-qualif.caas-cnp-apps-v2.com.intraorange,OU=Orange Business Services,O=Orange,L=Paris,ST=Paris,C=FR / issuer: CN=Orange Internal G2 Server CA,OU=FR 89 380129866,O=Orange,C=FR / serial: 39E5400000BE3547743EEABB89BF15AD9365A9EA / notbefore: Apr  4 16:03:28 2023 GMT / notafter: Apr  4 16:03:28 2025 GMT]]
 [Mon Mar 11 10:10:23 2024
Mar 11, 2024 @ 11:10:23.330
ERROR
 AH02275: Certificate Verification, depth 0, CRL checking mode: none (0) [subject: <PRESIDIO_ANONYMIZED_EMAIL_ADDRESS>,CN=*.sfs-qualif.caas-cnp-apps-v2.com.intraorange,OU=Orange Business Services,O=Orange,L=Paris,ST=Paris,C=FR / issuer: CN=Orange Internal G2 Server CA,OU=FR 89 380129866,O=Orange,C=FR / serial: 39E5400000BE3547743EEABB89BF15AD9365A9EA / notbefore: Apr  4 16:03:28 2023 GMT / notafter: Apr  4 16:03:28 2025 GMT]
logs-sfs.error@custom: processors grok in pipeline logs-sfs.error@custom failed with message Provided Grok expressions do not match field value: [ AH02275: Certificate Verification, depth 0, CRL checking mode: none (0) [subject: <PRESIDIO_ANONYMIZED_EMAIL_ADDRESS>,CN=*.sfs-qualif.caas-cnp-apps-v2.com.intraorange,OU=Orange Business Services,O=Orange,L=Paris,ST=Paris,C=FR / issuer: CN=Orange Internal G2 Server CA,OU=FR 89 380129866,O=Orange,C=FR / serial: 39E5400000BE3547743EEABB89BF15AD9365A9EA / notbefore: Apr  4 16:03:28 2023 GMT / notafter: Apr  4 16:03:28 2025 GMT]]
 [Mon Mar 11 10:10:23 2024
Mar 11, 2024 @ 11:10:23.330
ERROR
 AH02041: Protocol: TLSv1.2, Cipher: ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)
logs-sfs.error@custom: processors grok in pipeline logs-sfs.error@custom failed with message Provided Grok expressions do not match field value: [ AH02041: Protocol: TLSv1.2, Cipher: ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)]
 [Mon Mar 11 10:10:23 2024
Mar 11, 2024 @ 11:10:23.332
ERROR
 AH02041: Protocol: TLSv1.2, Cipher: ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)
logs-sfs.error@custom: processors grok in pipeline logs-sfs.error@custom failed with message Provided Grok expressions do not match field value: [ AH02041: Protocol: TLSv1.2, Cipher: ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)]
 [Mon Mar 11 10:10:23 2024
Mar 11, 2024 @ 11:10:23.333
ERROR
 AH01384: Zlib: Compressed 17893 to 2050 : URL /genericdashboard/api/api/v1/domains/ORDERING/reports/step_based_report/data, referer https://my-service-space-uat.orange-business.com/wacsmss/group/mssportal/ordering
logs-sfs.error@custom: processors grok in pipeline logs-sfs.error@custom failed with message Provided Grok expressions do not match field value: [ AH01384: Zlib: Compressed 17893 to 2050 : URL /genericdashboard/api/api/v1/domains/ORDERING/reports/step_based_report/data, referer https://my-service-space-uat.orange-business.com/wacsmss/group/mssportal/ordering]
 [Mon Mar 11 10:10:32 2024
Mar 11, 2024 @ 11:10:32.104
ERROR
 AH02642: proxy: connection shutdown
logs-sfs.error@custom: processors grok in pipeline logs-sfs.error@custom failed with message Provided Grok expressions do not match field value: [ AH02642: proxy: connection shutdown]
 [Mon Mar 11 10:10:32 2024
Mar 11, 2024 @ 11:10:32.104
ERROR
 [Mon Mar 11 10:10:32 2024] [debug] proxy_util.c(2346): AH00943: *: has released connection for (*)
logs-sfs.error@custom: processors dissect in pipeline logs-sfs.error@custom failed with message Unable to find match for dissect pattern: %{logdate}] [%{log_level}] %{filename}(%{linenumber}): [%{client_ipwrapper}]%{message} against source:  [Mon Mar 11 10:10:32 2024] [debug] proxy_util.c(2346): AH00943: *: has released connection for (*)
 - 
Mar 11, 2024 @ 11:10:32.104
ERROR
 AH02001: Connection closed to child 0 with standard shutdown (server SFS-RP:80)
logs-sfs.error@custom: processors grok in pipeline logs-sfs.error@custom failed with message Provided Grok expressions do not match field value: [ AH02001: Connection closed to child 0 with standard shutdown (server SFS-RP:80)]
 [Mon Mar 11 10:10:32 2024
Mar 11, 2024 @ 11:10:32.104
ERROR
 [Mon Mar 11 10:10:23 2024] [info] [client 10.235.70.188:443] AH01964: Connection to child 0 established (server SFS-RP:80)
logs-sfs.error@custom: processors dissect in pipeline logs-sfs.error@custom failed with message Unable to find match for dissect pattern: %{logdate}] [%{log_level}] %{filename}(%{linenumber}): [%{client_ipwrapper}]%{message} against source:  [Mon Mar 11 10:10:23 2024] [info] [client 10.235.70.188:443] AH01964: Connection to child 0 established (server SFS-RP:80)
 - 
Mar 11, 2024 @ 11:10:23.323


[
  {
    "dissect": {
      "field": "event.original",
      "pattern": "\"APACHE-%{event.type}-%{service.id}-%{+service.id}-%{+service.id}-%{+service.id}-%{+service.id}-%{service.version}\"%{message}",
      "append_separator": "-"
    }
  },
  {
    "dissect": {
      "field": "message",
      "pattern": "%{logdate}] [%{log_level}] %{filename}(%{linenumber}): [%{client_ipwrapper}]%{message}"
    }
  },
  {
    "grok": {
      "field": "message",
      "patterns": [
        "\\[%{DATA:client_ip}\\] %{DATA:action} %{GREEDYDATA:additional_info}"
      ]
    }
  },
  {
    "grok": {
      "field": "additional_info",
      "patterns": [
        "to %{IP:destination_ip}:%{POSINT:destination_port}",
        "depth %{INT:ssl_depth}, CRL checking mode: %{DATA:crl_mode} \\[subject: %{GREEDYDATA:certificate_subject} / issuer: %{GREEDYDATA:certificate_issuer} / serial: %{DATA:certificate_serial} / notbefore: %{DATA:certificate_notbefore} / notafter: %{DATA:certificate_notafter}\\]",
        "Protocol: %{DATA:protocol}, Cipher: %{DATA:cipher} \\(%{NUMBER:bits}/%{NUMBER:bits_max} bits\\)"
      ]
    }
  },
  {
    "date": {
      "field": "tmp.timestamp",
      "formats": [
        "EEE MMM dd HH:mm:ss yyyy"
      ],
      "target_field": "@timestamp"
    }
  }
]


[
  {
    "set": {
      "field": "error.message",
      "value": "{{_ingest.pipeline}}: processors {{_ingest.on_failure_processor_type}} in pipeline {{_ingest.on_failure_pipeline}} failed with message {{_ingest.on_failure_message}}"
    }
  }
]

the first dissect is there to dissect the full log in event.original that start like this “APACHE-ERROR-SFS-RPXD-MSS-MSS-UAT-G03R04C12”, but i block startin the date