nginx access logs to Elasticsearch, parsed into semantic conventions

extensions:
  file_storage:
    directory: /var/lib/otelcol/storage
    create_directory: true

receivers:
  filelog:
    include: [/var/log/nginx/access.log]
    start_at: end
    storage: file_storage
    operators:
      # Combined log format: client, user, time, request line, status, bytes,
      # referer, user agent. The request line is split into method, path,
      # query and protocol version.
      - type: regex_parser
        regex: '^(?P<client_address>\S+) \S+ (?P<user_name>\S+) \[(?P<time>[^\]]+)\] "(?P<method>[A-Z]+) (?P<path>[^ ?"]*)(?:\?(?P<query>[^ "]*))? HTTP/(?P<protocol_version>[0-9.]+)" (?P<status>\d{3}) (?P<size>\d+|-) "(?P<referer>[^"]*)" "(?P<user_agent>[^"]*)"'
        timestamp:
          parse_from: attributes.time
          layout: '%d/%b/%Y:%H:%M:%S %z'
        on_error: send

processors:
  memory_limiter:
    check_interval: 1s
    limit_percentage: 80
    spike_limit_percentage: 25
  transform/semconv:
    error_mode: ignore
    log_statements:
      - context: log
        # Only lines the regex parsed: an unparsed line keeps its body and
        # gets none of these attributes.
        conditions:
          - attributes["method"] != nil
        statements:
          - set(attributes["client.address"], attributes["client_address"])
          - set(attributes["user.name"], attributes["user_name"]) where attributes["user_name"] != "-"
          - set(attributes["http.request.method"], attributes["method"])
          - set(attributes["url.path"], attributes["path"])
          - set(attributes["url.query"], attributes["query"]) where attributes["query"] != nil and attributes["query"] != ""
          - set(attributes["network.protocol.name"], "http")
          - set(attributes["network.protocol.version"], attributes["protocol_version"])
          - set(attributes["http.response.status_code"], Int(attributes["status"]))
          - set(attributes["http.response.body.size"], Int(attributes["size"])) where attributes["size"] != "-"
          - set(attributes["http.request.header.referer"], [attributes["referer"]]) where attributes["referer"] != "-"
          - set(attributes["user_agent.original"], attributes["user_agent"])
          - delete_matching_keys(attributes, "^(client_address|user_name|time|method|path|query|protocol_version|status|size|referer|user_agent)$")
  batch:
    timeout: 5s

exporters:
  elasticsearch:
    endpoints: [https://elasticsearch.example.internal:9200]
    api_key: ${env:ELASTICSEARCH_API_KEY}
    mapping:
      mode: otel
    logs_index: logs-nginx-access
    sending_queue:
      enabled: true
      queue_size: 5000
    retry_on_failure:
      enabled: true
      initial_interval: 5s
      max_interval: 30s
      max_elapsed_time: 300s

service:
  extensions: [file_storage]
  pipelines:
    logs:
      receivers: [filelog]
      processors: [memory_limiter, transform/semconv, batch]
      exporters: [elasticsearch]