Add support for multi-core thread_id in filebeat postgresql module

CHANGELOG.asciidoc

@@ -83,6 +83,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha1...master[Check the HEAD d
 - Added `detect_null_bytes` selector to detect null bytes from a io.reader. {pull}9210[9210]
 - Added `syslog_host` variable to HAProxy module to allow syslog listener to bind to configured host. {pull}9366[9366]
 - Added support on Traefik for Common Log Format and Combined Log Format mixed which is the default Traefik format {issue}8015[8015] {issue}6111[6111] {pull}8768[8768].
+- Add support for multi-core thread_id in postgresql module {issue}9156[9156]
 
 *Heartbeat*
 

filebeat/docs/fields.asciidoc

@@ -5733,6 +5733,16 @@ type: long
 Process id
 
 
+--
+
+*`postgresql.log.core_id`*::
++
+--
+type: long
+
+Core id
+
+
 --
 
 *`postgresql.log.user`*::

filebeat/module/postgresql/log/_meta/fields.yml

@@ -12,7 +12,11 @@
     - name: thread_id
       type: long
       description: >
-          Process id
+        Process id
+    - name: core_id
+      type: long
+      description: >
+        Core id
     - name: user
       example: "admin"
       description:

filebeat/module/postgresql/log/ingest/pipeline.json

@@ -6,7 +6,7 @@
         "field": "message",
         "ignore_missing": true,
         "patterns": [
-            "^%{LOCALDATETIME:postgresql.log.timestamp} %{WORD:postgresql.log.timezone} \\[%{NUMBER:postgresql.log.thread_id}\\] ((\\[%{USERNAME:postgresql.log.user}\\]@\\[%{POSTGRESQL_DB_NAME:postgresql.log.database}\\]|%{USERNAME:postgresql.log.user}@%{POSTGRESQL_DB_NAME:postgresql.log.database}) )?%{WORD:postgresql.log.level}:  (duration: %{NUMBER:postgresql.log.duration} ms  statement: %{GREEDYDATA:postgresql.log.query}|%{GREEDYDATA:postgresql.log.message})"
+            "^%{LOCALDATETIME:postgresql.log.timestamp} %{WORD:postgresql.log.timezone} \\[%{NUMBER:postgresql.log.thread_id}(-%{BASE16FLOAT:postgresql.log.core_id})?\\] ((\\[%{USERNAME:postgresql.log.user}\\]@\\[%{POSTGRESQL_DB_NAME:postgresql.log.database}\\]|%{USERNAME:postgresql.log.user}@%{POSTGRESQL_DB_NAME:postgresql.log.database}) )?%{WORD:postgresql.log.level}:  (duration: %{NUMBER:postgresql.log.duration} ms  statement: %{GREEDYDATA:postgresql.log.query}|%{GREEDYDATA:postgresql.log.message})"
         ],
         "pattern_definitions": {
           "LOCALDATETIME": "[-0-9]+ %{TIME}",

filebeat/module/postgresql/log/test/postgresql-9.6-multi-core.log

@@ -0,0 +1,19 @@
+2018-11-17 13:14:01 CEST [12975-1] [unknown]@[unknown] LOG:  incomplete startup packet
+2018-11-17 13:16:03 CEST [5404-1] postgres@user FATAL:  database "user" does not exist
+2018-11-17 13:39:21 CEST [5404-2] postgres@postgres LOG:  duration: 37.598 ms  statement: SELECT n.nspname as "Schema",
+	  c.relname as "Name",
+	  CASE c.relkind WHEN 'r' THEN 'table' WHEN 'v' THEN 'view' WHEN 'm' THEN 'materialized view' WHEN 'i' THEN 'index' WHEN 'S' THEN 'sequence' WHEN 's' THEN 'special' WHEN 'f' THEN 'foreign table' END as "Type",
+	  pg_catalog.pg_get_userbyid(c.relowner) as "Owner"
+	FROM pg_catalog.pg_class c
+	     LEFT JOIN pg_catalog.pg_namespace n ON n.oid = c.relnamespace
+	WHERE c.relkind IN ('r','')
+	      AND n.nspname <> 'pg_catalog'
+	      AND n.nspname <> 'information_schema'
+	      AND n.nspname !~ '^pg_toast'
+	  AND pg_catalog.pg_table_is_visible(c.oid)
+	ORDER BY 1,2;
+2018-11-17 13:39:22 EST [835-1] LOG:  autovacuum launcher started
+2018-11-17 13:41:38 EST [832-1] LOG:  checkpoints are occurring too frequently (25 seconds apart)
+2018-11-17 13:41:38 EST [832-2] HINT:  Consider increasing the configuration parameter "max_wal_size".
+2018-11-17 13:53:56 EST [768-1] postgres@postgres FATAL:  the database system is starting up
+2018-11-17 13:53:57 EST [771-1] postgres@postgres FATAL:  the database system is starting up