POST _ingest/pipeline/rk-siem_web_logs/_simulate
{
  "docs": [
    {
      "_source": {
        "log": "192.168.1.10 - - [23/Apr/2026:14:00:12 +0000] \"DELETE /index.html HTTP/1.1\" 500 5124"
      }
    }
  ]
}