As a configuration option, create another pipeline inside the module to
parse CSV log files.

Although it's necessary to configure the database to emit such logs,
there is some advantages: configured properly, some events like
`statement timeout` and `lock timeout` will display the query in the
same event, opposed to multiple lines, one with the error message and
other with statement.

Do not generate duplicate field groups.

Co-authored-by: Jaime Soriano Pastor <jaime.soriano@elastic.co>

Commit cacde06 changed field names.

I commited in github without pay attention to tests. This commit fixes
all tests and the pipeline.

* Adding postgresql.log.query_name in grok

The query_step was ignored because it's a subset of command_tag

* Separate message and query fields

Message is the main message, and query is what message is referencing

There is no `core_id` inside PostgreSQL logs. Deprecating field and moving
it to `session_line_number`.

This commit will open the path to add 2 pipelines:

- The default one, using log files
- The CSV pipeline

Since both files represent the same information, makes sense to have
only one fileset.

Creates a new grok pattern to match only the timestamp and the next
char, the separator.

Based on separator, choose the right pipeline.

Both of then represents the same information, so use the same pipeline
to do the job.

- remove unused `thread_id` field
- issue a `make update`

Drop `postgresql.log.error_severity` in favor of `log.level`

Based on PostgreSQL Error Codes, everything that not starts with `00`,
`01` or `02` is an error.

Regenerate files to have a consistent field order.

This field is a long, but postgresql errors can have letters. For now
just the deprecation, a naive change in grok will break the parser.

Co-authored-by: Jaime Soriano Pastor <jaime.soriano@elastic.co>

Co-authored-by: Jaime Soriano Pastor <jaime.soriano@elastic.co>

Use `raw_message` instead of `message2`.

According to PostgreSQL docs, this code is not a number:

https://www.postgresql.org/docs/current/errcodes-appendix.html

Stop collecting it and move it `sql_state_code`

…_code

After deprecate the field, stop to populate it.

Give more details to `details` and `hints` and change `error.code` to an
alias.

The previous logic tag all messages as "info" and then append "error" if
it's the case.

Put a conditional to not have "event.type": ["info", "error"].

Change part of the description to a comment

Co-authored-by: Jaime Soriano Pastor <jaime.soriano@elastic.co>

- Run update since last `fields.yml` was done only in github
- Use `set` instead of `append` in pipeline to not create an array
- Capture the `postgresql.log.query_step` in csv pipeline

Now PostgreSQL has 3 files in the ingest directory:

- pipeline.yml
- pipeline-log.yml
- pipeline-csv.yml

Change the count to 3 to reflect that.

postresql.log.sql_state_code -> `postgresql.log.sql_state_code`.

Co-authored-by: Jaime Soriano Pastor <jaime.soriano@elastic.co>