---
description: Pipeline for PanOS User ID Logs
processors:
  - grok:
      field: _temp_.srcuser
      ignore_missing: true
      ignore_failure: true
      patterns:
        - '%{HOSTNAME:source.user.domain}\\%{USERNAME:source.user.name}'
        - '%{USERNAME:source.user.name}@%{HOSTNAME:source.user.domain}'
        - '%{USERNAME:source.user.name}'
      if: ctx?._temp_?.srcuser != null
  - set:
      field: network.type
      value: 'ipv4'
      if: 'ctx?.network?.type == null && ctx?.source?.ip.contains(".")'
  - set:
      field: network.type
      value: 'ipv6'
      if: 'ctx?.network?.type == null && ctx?.source?.ip.contains(":")'
  - date:
      if: "ctx?.panw?.panos?.factorcompletiontime != null && ctx.event.timezone == null"
      field: "panw.panos.factorcompletiontime"
      target_field: "panw.panos.factorcompletiontime"
      formats:
        - "yyyy/MM/dd HH:mm:ss"
      on_failure: [{"append": {"field": "error.message", "value": "{{ _ingest.on_failure_message }}"}}]
  - date:
      if: "ctx?.panw?.panos?.factorcompletiontime != null && ctx.event.timezone != null"
      field: "panw.panos.factorcompletiontime"
      target_field: "panw.panos.factorcompletiontime"
      formats:
        - "yyyy/MM/dd HH:mm:ss"
      timezone: "{{ event.timezone }}"
      on_failure: [{"append": {"field": "error.message", "value": "{{ _ingest.on_failure_message }}"}}]

on_failure:
  - append:
      field: error.message
      value: >-
        error in User ID pipeline:
        error in [{{_ingest.on_failure_processor_type}}] processor{{#_ingest.on_failure_processor_tag}}
        with tag [{{_ingest.on_failure_processor_tag }}]{{/_ingest.on_failure_processor_tag}}
        {{ _ingest.on_failure_message }}
