[FileBeat][Postgresql] Parse <unnamed> query log format

[MarcinAman]

Describe the enhancement:
As far as i can tell postgresql module doesn't support format with parse <unnamed>:

2019-09-04 15:52:38.004 CEST [31136] user@host LOG:  duration: 12.437 ms  parse <unnamed>: select * from table

It requires a statement keyword which is not always present so values are not parsed correctly

Describe a specific use case for the enhancement or feature:
Right now users are forced to create custom injests and it takes time...

[ziksi]

Hello,
it does not support also execute, bind and so on.
Example slow queries:
duration: 256.251 ms execute dbdpg_p44583_29: ...
duration: 739.010 ms execute pdo_stmt_00000002: ...
For temporay fix you can use: ( in modules/postgresql/log/ingest/pipeline.json)
"patterns": [
"^%{LOCALDATETIME:postgresql.log.timestamp} %{WORD:postgresql.log.timezone} \[%{NUMBER:postgresql.log.thread_id}(-%{BASE16FLOAT:postgresql.log.core_id})?\] ((\[%{USERNAME:postgresql.log.user}\]@\[%{POSTGRESQL_DB_NAME:postgresql.log.database}\]|%{USERNAME:postgresql.log.user}@%{POSTGRESQL_DB_NAME:postgresql.log.database}) )?%{WORD:postgresql.log.level}: (duration: %{NUMBER:postgresql.log.duration} ms .: %{GREEDYDATA:postgresql.log.query}|%{GREEDYDATA:postgresql.log.message})"
],
in which "ms statement:" is only changed to "ms .:"

In that way slow queries will be matched and parsed properly and will be shown correctly in both PostgreSQL dashboards.

[MarcinAman]

Thanks, it works :)

For those that will google that issue later:
If you change a ingest definition (this .json file) you need to setup a pipeline once again (use filebeat setup --pipelines -modules=postgresql and disable/enable module).

[jsoriano]

@MarcinAman @ziksi thanks for reporting this and providing some examples!
I have opened #13701 to address this issue. It'd be great if you could take a look to the PR or provide some additional example log files that contain slow log entries with these query steps.