input {
    beats {
        port => 5044
    }
}

filter {
    grok {
        match => ["message", "%{GREEDYDATA:UNWANTED}\ SYNAPSE_ANALYTICS_DATA %{GREEDYDATA:analyticJson}"]
    }
    json {
        source => "analyticJson"
        target => "analytic"
    }

    mutate {
        copy => {"[analytic][payload][entityType]" => "[@metadata][appNameIndex]"}
    }

    mutate {
        remove_field => [ "UNWANTED", "analyticJson", "message" ]
    }

    mutate {
        lowercase => ["[@metadata][appNameIndex]"]
    }
}
output {
    elasticsearch {
       hosts => ["https://localhost:9200"]
       user => "logstash_internal"
       password => "yoYq2O66@aHekc*K"
       index => "wso2-mi-analytics-%{[@metadata][appNameIndex]}"
       ssl => true
       ssl_certificate_verification => true
       cacert => "/Users/sulochana/docs/elasticsearch-8.3.2/config/certs/http_ca.crt"       
    }
}