diff --git a/packages/activemq/_dev/build/docs/README.md b/packages/activemq/_dev/build/docs/README.md
index 8939e70d5bf..e21ed4351dd 100644
--- a/packages/activemq/_dev/build/docs/README.md
+++ b/packages/activemq/_dev/build/docs/README.md
@@ -30,7 +30,11 @@ Note:
 
 ## Compatibility
 
-This integration has been tested against ActiveMQ 5.17.1 (independent from the operating system).
+This integration targets **Apache ActiveMQ Classic**. Elastic package system tests can run against **ActiveMQ Classic 6.2.2** (default) or **5.17.1** (see `_dev/deploy/variants.yml`). Use a **Java 17 or newer** JVM in the test image; ActiveMQ Classic 6.2.x requires Java 17+ on the broker, and 5.17.x runs on Java 17 for these tests.
+
+Metrics are collected through the embedded **Jolokia** endpoint (Jolokia 2.x in ActiveMQ 6.2.x). The default path (`/api/jolokia/?ignoreErrors=true&canonicalNaming=false`) matches the web console `/api` context from the upstream distribution.
+
+Log and audit parsing follow the default log line formats described below, which match the pipeline test fixtures for this package.
 
 ## What do I need to use this integration?
 
diff --git a/packages/activemq/_dev/deploy/docker/Dockerfile b/packages/activemq/_dev/deploy/docker/Dockerfile
index b41dc72510d..175232e9e97 100644
--- a/packages/activemq/_dev/deploy/docker/Dockerfile
+++ b/packages/activemq/_dev/deploy/docker/Dockerfile
@@ -1,6 +1,6 @@
-FROM eclipse-temurin:11-jre
+FROM eclipse-temurin:17-jre
 
-ARG SERVICE_VERSION=${SERVICE_VERSION:-5.17.1}
+ARG SERVICE_VERSION=${SERVICE_VERSION:-6.2.2}
 ENV ACTIVEMQ_VERSION=${SERVICE_VERSION}
 
 ENV ACTIVEMQ_HOME /opt/activemq
@@ -31,4 +31,4 @@ EXPOSE $ACTIVEMQ_STOMP $ACTIVEMQ_REST
 HEALTHCHECK --interval=1s --retries=90 CMD nc -w 1 -v 127.0.0.1 $ACTIVEMQ_STOMP </dev/null && \
     nc -w 1 -v 127.0.0.1 $ACTIVEMQ_REST </dev/null
 
-CMD ["/bin/sh", "-c", "bin/activemq console & ./entrypoint.d/entrypoint.sh"]
\ No newline at end of file
+CMD ["/bin/sh", "-c", "./entrypoint.d/entrypoint.sh"]
\ No newline at end of file
diff --git a/packages/activemq/_dev/deploy/docker/docker-compose.yml b/packages/activemq/_dev/deploy/docker/docker-compose.yml
index 7686d1554c5..308fab1f6d7 100644
--- a/packages/activemq/_dev/deploy/docker/docker-compose.yml
+++ b/packages/activemq/_dev/deploy/docker/docker-compose.yml
@@ -4,9 +4,11 @@ services:
     build: .
     volumes:
       - ./sample_logs:/sample_logs:ro
-      - ${SERVICE_LOGS_DIR}:/opt/apache-activemq-5.17.1/logs/
-      - ./files/jetty.xml:/opt/apache-activemq-5.17.1/conf/jetty.xml
-      - ./files/jolokia-access.xml:/opt/apache-activemq-5.17.1/conf/jolokia-access.xml
+      - ${SERVICE_LOGS_DIR}:/opt/activemq/logs/
+      - ./files/jetty-5.17.xml:/integration-templates/jetty-5.17.xml:ro
+      - ./files/jetty-6.2.xml:/integration-templates/jetty-6.2.xml:ro
+      - ./files/jolokia-5.17.xml:/integration-templates/jolokia-5.17.xml:ro
+      - ./files/jolokia-6.2.xml:/integration-templates/jolokia-6.2.xml:ro
     ports:
       - 8161
       - 61613
diff --git a/packages/activemq/_dev/deploy/docker/entrypoint.d/entrypoint.sh b/packages/activemq/_dev/deploy/docker/entrypoint.d/entrypoint.sh
index 3d1a8de3227..8f7c8d83b1d 100644
--- a/packages/activemq/_dev/deploy/docker/entrypoint.d/entrypoint.sh
+++ b/packages/activemq/_dev/deploy/docker/entrypoint.d/entrypoint.sh
@@ -1,13 +1,27 @@
+#!/bin/sh
+# Install Jetty / Jolokia overrides that match the ActiveMQ major line before the broker starts.
+case "${ACTIVEMQ_VERSION}" in
+  5.*)
+    cp /integration-templates/jetty-5.17.xml "${ACTIVEMQ_HOME}/conf/jetty.xml"
+    cp /integration-templates/jolokia-5.17.xml "${ACTIVEMQ_HOME}/conf/jolokia-access.xml"
+    ;;
+  *)
+    cp /integration-templates/jetty-6.2.xml "${ACTIVEMQ_HOME}/conf/jetty.xml"
+    cp /integration-templates/jolokia-6.2.xml "${ACTIVEMQ_HOME}/conf/jolokia-access.xml"
+    ;;
+esac
+
 # Whenever docker container is ran it will remove log files from SERVICE_LOGS_DIR, so to make them accessible again for the docker container to run system test,
-# following commands will help to copy and accesses these files from SERVICE_LOGS_DIR again. 
-mkdir logs
-cp /sample_logs/* /opt/apache-activemq-5.17.1/logs/ 
-chmod a+rw -R /opt/apache-activemq-5.17.1/logs/ 
+# following commands will help to copy and accesses these files from SERVICE_LOGS_DIR again.
+mkdir -p "${ACTIVEMQ_HOME}/logs"
+cp /sample_logs/* "${ACTIVEMQ_HOME}/logs/" 2>/dev/null || true
+chmod a+rw -R "${ACTIVEMQ_HOME}/logs/"
+
+bin/activemq console &
 sleep 10
 
 while :
 do
     curl -u admin:admin -d "body=message" http://localhost:8161/api/message/TEST?type=queue
-    sleep 1  
+    sleep 1
 done
-
diff --git a/packages/activemq/_dev/deploy/docker/files/jetty.xml b/packages/activemq/_dev/deploy/docker/files/jetty-5.17.xml
similarity index 100%
rename from packages/activemq/_dev/deploy/docker/files/jetty.xml
rename to packages/activemq/_dev/deploy/docker/files/jetty-5.17.xml
diff --git a/packages/activemq/_dev/deploy/docker/files/jetty-6.2.xml b/packages/activemq/_dev/deploy/docker/files/jetty-6.2.xml
new file mode 100644
index 00000000000..cb813728985
--- /dev/null
+++ b/packages/activemq/_dev/deploy/docker/files/jetty-6.2.xml
@@ -0,0 +1,219 @@
+<!--
+        Licensed to the Apache Software Foundation (ASF) under one or more contributor
+        license agreements. See the NOTICE file distributed with this work for additional
+        information regarding copyright ownership. The ASF licenses this file to You under
+        the Apache License, Version 2.0 (the "License"); you may not use this file except in
+        compliance with the License. You may obtain a copy of the License at
+
+        http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or
+        agreed to in writing, software distributed under the License is distributed on an
+        "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+        implied. See the License for the specific language governing permissions and
+        limitations under the License.
+    -->
+    <!--
+        An embedded servlet engine for serving up the Admin consoles, REST and Ajax APIs and
+        some demos Include this file in your configuration to enable ActiveMQ web components
+        e.g. <import resource="jetty.xml"/>
+    -->
+<beans xmlns="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd">
+
+    <bean id="httpConfig" class="org.eclipse.jetty.server.HttpConfiguration">
+        <property name="sendServerVersion" value="false"/>
+    </bean>
+
+    <bean id="jaasLoginService" class="org.eclipse.jetty.jaas.JAASLoginService">
+        <property name="name" value="ActiveMQRealm"/>
+        <property name="loginModuleName" value="activemq"/>
+        <property name="roleClassNames">
+            <list>
+                <value>org.apache.activemq.jaas.GroupPrincipal</value>
+            </list>
+        </property>
+    </bean>
+
+    <bean id="identityService" class="org.eclipse.jetty.security.DefaultIdentityService"/>
+
+    <bean id="securityConstraint" class="org.eclipse.jetty.util.security.Constraint">
+        <property name="name" value="BASIC" />
+        <property name="roles" value="users,admins" />
+        <!-- set authenticate=false to disable login -->
+        <property name="authenticate" value="true" />
+    </bean>
+    <bean id="adminSecurityConstraint" class="org.eclipse.jetty.util.security.Constraint">
+        <property name="name" value="BASIC" />
+        <property name="roles" value="admins" />
+         <!-- set authenticate=false to disable login -->
+        <property name="authenticate" value="true" />
+    </bean>
+    <bean id="securityConstraintMapping" class="org.eclipse.jetty.security.ConstraintMapping">
+        <property name="constraint" ref="securityConstraint" />
+        <property name="pathSpec" value="/" />
+    </bean>
+    <bean id="adminSecurityConstraintMapping" class="org.eclipse.jetty.security.ConstraintMapping">
+        <property name="constraint" ref="adminSecurityConstraint" />
+        <property name="pathSpec" value="*.action" />
+    </bean>
+    
+    <bean id="rewriteHandler" class="org.eclipse.jetty.rewrite.handler.RewriteHandler">
+        <property name="rules">
+            <list>
+                <bean id="header" class="org.eclipse.jetty.rewrite.handler.HeaderPatternRule">
+                  <property name="pattern" value="*"/>
+                  <property name="name" value="X-FRAME-OPTIONS"/>
+                  <property name="value" value="SAMEORIGIN"/>
+                </bean>
+                <bean id="header" class="org.eclipse.jetty.rewrite.handler.HeaderPatternRule">
+                  <property name="pattern" value="*"/>
+                  <property name="name" value="X-XSS-Protection"/>
+                  <property name="value" value="1; mode=block"/>
+                </bean>
+                <bean id="header" class="org.eclipse.jetty.rewrite.handler.HeaderPatternRule">
+                  <property name="pattern" value="*"/>
+                  <property name="name" value="X-Content-Type-Options"/>
+                  <property name="value" value="nosniff"/>
+                </bean>
+                <bean id="header" class="org.eclipse.jetty.rewrite.handler.HeaderPatternRule">
+                    <property name="pattern" value="*"/>
+                    <property name="name" value="Cache-Control"/>
+                    <property name="value" value="no-store"/>
+                </bean>
+                <bean id="header" class="org.eclipse.jetty.rewrite.handler.HeaderPatternRule">
+                    <property name="pattern" value="*"/>
+                    <property name="name" value="Content-Security-Policy"/>
+                    <property name="value" value="style-src-elem 'self'; style-src 'self'; img-src 'self'; script-src-elem 'self'; default-src 'none'; object-src 'none'; frame-ancestors 'none'; base-uri 'none';" />
+                </bean>
+                <!-- More relaxed rules to allow browsers to properly render XML -->
+                <bean id="header" class="org.eclipse.jetty.rewrite.handler.HeaderPatternRule">
+                    <property name="pattern" value="/admin/xml/*"/>
+                    <property name="name" value="Content-Security-Policy"/>
+                    <property name="value" value="style-src-elem 'self' 'unsafe-inline'; style-src 'self'; img-src 'self' data:; script-src-elem 'self'; default-src 'none'; object-src 'none'; frame-ancestors 'none'; base-uri 'none';" />
+                </bean>
+            </list>
+        </property>
+    </bean>
+    
+    <bean id="secHandlerCollection" class="org.eclipse.jetty.server.handler.HandlerCollection">
+        <property name="handlers">
+            <list>
+                <ref bean="rewriteHandler"/>
+                <bean class="org.eclipse.jetty.webapp.WebAppContext">
+                    <property name="contextPath" value="/admin" />
+                    <property name="resourceBase" value="${activemq.home}/webapps/admin" />
+                    <property name="logUrlOnStart" value="true" />
+                </bean>
+                <bean class="org.eclipse.jetty.webapp.WebAppContext">
+                    <property name="contextPath" value="/api" />
+                    <property name="resourceBase" value="${activemq.home}/webapps/api" />
+                    <property name="logUrlOnStart" value="true" />
+                </bean>
+                <bean class="org.eclipse.jetty.server.handler.ResourceHandler">
+                    <property name="directoriesListed" value="false" />
+                    <property name="welcomeFiles">
+                        <list>
+                            <value>index.html</value>
+                        </list>
+                    </property>
+                    <property name="resourceBase" value="${activemq.home}/webapps/" />
+                </bean>
+                <bean id="defaultHandler" class="org.eclipse.jetty.server.handler.DefaultHandler">
+                    <property name="serveIcon" value="false" />
+                </bean>
+            </list>
+        </property>
+    </bean>    
+    <bean id="securityHandler" class="org.eclipse.jetty.security.ConstraintSecurityHandler">
+        <property name="identityService" ref="identityService" />
+        <property name="loginService" ref="jaasLoginService" />
+        <property name="authenticator">
+            <bean class="org.eclipse.jetty.security.authentication.BasicAuthenticator" />
+        </property>
+        <property name="constraintMappings">
+            <list>
+                <ref bean="adminSecurityConstraintMapping" />
+                <ref bean="securityConstraintMapping" />
+            </list>
+        </property>
+        <property name="handler" ref="secHandlerCollection" />
+    </bean>
+
+    <bean id="contexts" class="org.eclipse.jetty.server.handler.ContextHandlerCollection">
+    </bean>
+
+    <bean id="jettyPort" class="org.apache.activemq.web.WebConsolePort" init-method="start">
+             <!-- the default port number for the web console -->
+        <property name="host" value="0.0.0.0"/>
+        <property name="port" value="8161"/>
+    </bean>
+
+    <bean id="Server" depends-on="jettyPort" class="org.eclipse.jetty.server.Server"
+        destroy-method="stop">
+
+        <property name="handler">
+            <bean id="handlers" class="org.eclipse.jetty.server.handler.HandlerCollection">
+                <property name="handlers">
+                    <list>
+                        <ref bean="contexts" />
+                        <ref bean="securityHandler" />
+                    </list>
+                </property>
+            </bean>
+        </property>
+
+    </bean>
+
+    <bean id="invokeConnectors" class="org.springframework.beans.factory.config.MethodInvokingFactoryBean">
+        <property name="targetObject" ref="Server" />
+        <property name="targetMethod" value="setConnectors" />
+        <property name="arguments">
+        <list>
+               <bean id="Connector" class="org.eclipse.jetty.server.ServerConnector">
+                   <constructor-arg ref="Server"/>
+                   <constructor-arg>
+                       <list>
+                           <bean id="httpConnectionFactory" class="org.eclipse.jetty.server.HttpConnectionFactory">
+                               <constructor-arg ref="httpConfig"/>
+                           </bean>
+                       </list>
+                   </constructor-arg>
+                   <!-- see the jettyPort bean -->
+                   <property name="host" value="#{systemProperties['jetty.host']}" />
+                   <property name="port" value="#{systemProperties['jetty.port']}" />
+               </bean>
+                <!--
+                    Enable this connector if you wish to use https with web console
+                -->
+                <!-- bean id="SecureConnector" class="org.eclipse.jetty.server.ServerConnector">
+                    <constructor-arg ref="Server" />
+                    <constructor-arg>
+                        <bean id="handlers" class="org.eclipse.jetty.util.ssl.SslContextFactory$Server">
+                            <property name="keyStorePath" value="${activemq.conf}/broker.ks" />
+                            <property name="keyStorePassword" value="password" />
+                        </bean>
+                    </constructor-arg>
+                    <property name="port" value="8162" />
+                </bean -->
+            </list>
+        </property>
+    </bean>
+
+    <bean id="configureJetty" class="org.springframework.beans.factory.config.MethodInvokingFactoryBean">
+        <property name="staticMethod" value="org.apache.activemq.web.config.JspConfigurer.configureJetty" />
+        <property name="arguments">
+            <list>
+                <ref bean="Server" />
+                <ref bean="secHandlerCollection" />
+            </list>
+        </property>
+    </bean>
+    
+    <bean id="invokeStart" class="org.springframework.beans.factory.config.MethodInvokingFactoryBean" 
+        depends-on="configureJetty, invokeConnectors">
+        <property name="targetObject" ref="Server" />
+        <property name="targetMethod" value="start" />      
+    </bean>
+    
+    
+</beans>
+
diff --git a/packages/activemq/_dev/deploy/docker/files/jolokia-access.xml b/packages/activemq/_dev/deploy/docker/files/jolokia-5.17.xml
similarity index 100%
rename from packages/activemq/_dev/deploy/docker/files/jolokia-access.xml
rename to packages/activemq/_dev/deploy/docker/files/jolokia-5.17.xml
diff --git a/packages/activemq/_dev/deploy/docker/files/jolokia-6.2.xml b/packages/activemq/_dev/deploy/docker/files/jolokia-6.2.xml
new file mode 100644
index 00000000000..77517534d20
--- /dev/null
+++ b/packages/activemq/_dev/deploy/docker/files/jolokia-6.2.xml
@@ -0,0 +1,81 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+  Licensed to the Apache Software Foundation (ASF) under one or more
+  contributor license agreements.  See the NOTICE file distributed with
+  this work for additional information regarding copyright ownership.
+  The ASF licenses this file to You under the Apache License, Version 2.0
+  (the "License"); you may not use this file except in compliance with
+  the License.  You may obtain a copy of the License at
+
+  http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+
+  Based on Apache ActiveMQ Classic 6.2.x conf/jolokia-access.xml, with relaxed
+  CORS and HTTP method settings so Elastic Agent / Metricbeat can read metrics
+  without browser Origin headers during integration tests.
+-->
+<restrict>
+
+  <cors>
+    <allow-origin>http://localhost:*</allow-origin>
+    <allow-origin>http://127.0.0.1:*</allow-origin>
+    <allow-origin>*</allow-origin>
+  </cors>
+
+  <http>
+    <method>post</method>
+    <method>get</method>
+  </http>
+
+  <!-- By default don't allow write or exec operations -->
+  <commands>
+    <command>read</command>
+    <command>list</command>
+    <command>version</command>
+    <command>search</command>
+  </commands>
+
+  <allow>
+    <!-- Allow all operations for the broker itself -->
+    <mbean>
+      <name>org.apache.activemq:*</name>
+      <attribute>*</attribute>
+      <operation>*</operation>
+    </mbean>
+    <!-- Allow all operations for Jolokia Config -->
+    <mbean>
+      <name>jolokia:type=Config</name>
+      <operation>*</operation>
+    </mbean>
+  </allow>
+
+  <!-- deny all operations or getting attributes from these mbeans -->
+  <deny>
+    <mbean>
+      <name>org.apache.logging.log4j2:*</name>
+      <attribute>*</attribute>
+      <operation>*</operation>
+    </mbean>
+    <mbean>
+      <name>com.sun.management:type=DiagnosticCommand</name>
+      <attribute>*</attribute>
+      <operation>*</operation>
+    </mbean>
+    <mbean>
+      <name>com.sun.management:type=HotSpotDiagnostic</name>
+      <attribute>*</attribute>
+      <operation>*</operation>
+    </mbean>
+    <mbean>
+      <name>jdk.management.jfr:type=FlightRecorder</name>
+      <attribute>*</attribute>
+      <operation>*</operation>
+    </mbean>
+  </deny>
+
+</restrict>
diff --git a/packages/activemq/_dev/deploy/variants.yml b/packages/activemq/_dev/deploy/variants.yml
index 01d8f85e581..a8e5f1def5a 100644
--- a/packages/activemq/_dev/deploy/variants.yml
+++ b/packages/activemq/_dev/deploy/variants.yml
@@ -1,4 +1,6 @@
 variants:
+  "v6.2.2":
+    SERVICE_VERSION: 6.2.2
   "v5.17.1":
     SERVICE_VERSION: 5.17.1
-default: v5.17.1
+default: v6.2.2
diff --git a/packages/activemq/changelog.yml b/packages/activemq/changelog.yml
index 29f86e3ca4c..4bbff0d84e4 100644
--- a/packages/activemq/changelog.yml
+++ b/packages/activemq/changelog.yml
@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "1.10.0"
+  changes:
+    - description: Align system tests and documentation with Apache ActiveMQ Classic 6.2.x (Java 17, Jetty 11 / Jolokia 2.x). Update deploy Docker assets (paths, version-specific jetty/jolokia templates) while keeping the 5.17.1 service variant for regression tests.
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/18417
 - version: "1.9.0"
   changes:
     - description: Improve documentation
diff --git a/packages/activemq/data_stream/audit/_dev/test/pipeline/test-audit.log b/packages/activemq/data_stream/audit/_dev/test/pipeline/test-audit-5-17.log
similarity index 100%
rename from packages/activemq/data_stream/audit/_dev/test/pipeline/test-audit.log
rename to packages/activemq/data_stream/audit/_dev/test/pipeline/test-audit-5-17.log
diff --git a/packages/activemq/data_stream/audit/_dev/test/pipeline/test-audit.log-expected.json b/packages/activemq/data_stream/audit/_dev/test/pipeline/test-audit-5-17.log-expected.json
similarity index 100%
rename from packages/activemq/data_stream/audit/_dev/test/pipeline/test-audit.log-expected.json
rename to packages/activemq/data_stream/audit/_dev/test/pipeline/test-audit-5-17.log-expected.json
diff --git a/packages/activemq/data_stream/audit/_dev/test/pipeline/test-audit-6-2.log b/packages/activemq/data_stream/audit/_dev/test/pipeline/test-audit-6-2.log
new file mode 100644
index 00000000000..ff48602f252
--- /dev/null
+++ b/packages/activemq/data_stream/audit/_dev/test/pipeline/test-audit-6-2.log
@@ -0,0 +1,4 @@
+INFO  | admin called org.apache.activemq.broker.jmx.QueueView.retryMessages[] at 15-04-2026 22:28:00,100 | qtp2064787513-43
+INFO  | guest called org.apache.activemq.broker.jmx.BrokerView.getBrokerName[] at 15-04-2026 22:28:00,215 | qtp2064787513-44
+WARN  | admin requested /admin/queues.jsp from 127.0.0.1 | qtp2064787513-45
+INFO  | anonymous called org.apache.activemq.broker.jmx.TopicView.getName[] at 15-04-2026 22:28:00,330 | qtp2064787513-46
diff --git a/packages/activemq/data_stream/audit/_dev/test/pipeline/test-audit-6-2.log-expected.json b/packages/activemq/data_stream/audit/_dev/test/pipeline/test-audit-6-2.log-expected.json
new file mode 100644
index 00000000000..19a3e75a60d
--- /dev/null
+++ b/packages/activemq/data_stream/audit/_dev/test/pipeline/test-audit-6-2.log-expected.json
@@ -0,0 +1,124 @@
+{
+    "expected": [
+        {
+            "@timestamp": "2020-04-28T11:07:58.223Z",
+            "activemq": {
+                "audit": {
+                    "thread": "qtp2064787513-43"
+                }
+            },
+            "ecs": {
+                "version": "8.11.0"
+            },
+            "event": {
+                "ingested": "2026-04-15T22:31:13.369621907Z",
+                "kind": "event",
+                "module": "activemq",
+                "original": "INFO  | admin called org.apache.activemq.broker.jmx.QueueView.retryMessages[] at 15-04-2026 22:28:00,100 | qtp2064787513-43",
+                "type": [
+                    "info"
+                ]
+            },
+            "log": {
+                "level": "INFO"
+            },
+            "message": "called org.apache.activemq.broker.jmx.QueueView.retryMessages[] at 15-04-2026 22:28:00,100",
+            "tags": [
+                "preserve_original_event"
+            ],
+            "user": {
+                "name": "admin"
+            }
+        },
+        {
+            "@timestamp": "2020-04-28T11:07:58.223Z",
+            "activemq": {
+                "audit": {
+                    "thread": "qtp2064787513-44"
+                }
+            },
+            "ecs": {
+                "version": "8.11.0"
+            },
+            "event": {
+                "ingested": "2026-04-15T22:31:13.369709034Z",
+                "kind": "event",
+                "module": "activemq",
+                "original": "INFO  | guest called org.apache.activemq.broker.jmx.BrokerView.getBrokerName[] at 15-04-2026 22:28:00,215 | qtp2064787513-44",
+                "type": [
+                    "info"
+                ]
+            },
+            "log": {
+                "level": "INFO"
+            },
+            "message": "called org.apache.activemq.broker.jmx.BrokerView.getBrokerName[] at 15-04-2026 22:28:00,215",
+            "tags": [
+                "preserve_original_event"
+            ],
+            "user": {
+                "name": "guest"
+            }
+        },
+        {
+            "@timestamp": "2020-04-28T11:07:58.223Z",
+            "activemq": {
+                "audit": {
+                    "thread": "qtp2064787513-45"
+                }
+            },
+            "ecs": {
+                "version": "8.11.0"
+            },
+            "event": {
+                "ingested": "2026-04-15T22:31:13.369723500Z",
+                "kind": "event",
+                "module": "activemq",
+                "original": "WARN  | admin requested /admin/queues.jsp from 127.0.0.1 | qtp2064787513-45",
+                "type": [
+                    "error"
+                ]
+            },
+            "log": {
+                "level": "WARN"
+            },
+            "message": "requested /admin/queues.jsp from 127.0.0.1",
+            "tags": [
+                "preserve_original_event"
+            ],
+            "user": {
+                "name": "admin"
+            }
+        },
+        {
+            "@timestamp": "2020-04-28T11:07:58.223Z",
+            "activemq": {
+                "audit": {
+                    "thread": "qtp2064787513-46"
+                }
+            },
+            "ecs": {
+                "version": "8.11.0"
+            },
+            "event": {
+                "ingested": "2026-04-15T22:31:13.369725751Z",
+                "kind": "event",
+                "module": "activemq",
+                "original": "INFO  | anonymous called org.apache.activemq.broker.jmx.TopicView.getName[] at 15-04-2026 22:28:00,330 | qtp2064787513-46",
+                "type": [
+                    "info"
+                ]
+            },
+            "log": {
+                "level": "INFO"
+            },
+            "message": "called org.apache.activemq.broker.jmx.TopicView.getName[] at 15-04-2026 22:28:00,330",
+            "tags": [
+                "preserve_original_event"
+            ],
+            "user": {
+                "name": "anonymous"
+            }
+        }
+    ]
+}
diff --git a/packages/activemq/data_stream/log/_dev/test/pipeline/test-activemq.log b/packages/activemq/data_stream/log/_dev/test/pipeline/test-activemq-5-15.log
similarity index 100%
rename from packages/activemq/data_stream/log/_dev/test/pipeline/test-activemq.log
rename to packages/activemq/data_stream/log/_dev/test/pipeline/test-activemq-5-15.log
diff --git a/packages/activemq/data_stream/log/_dev/test/pipeline/test-activemq.log-expected.json b/packages/activemq/data_stream/log/_dev/test/pipeline/test-activemq-5-15.log-expected.json
similarity index 100%
rename from packages/activemq/data_stream/log/_dev/test/pipeline/test-activemq.log-expected.json
rename to packages/activemq/data_stream/log/_dev/test/pipeline/test-activemq-5-15.log-expected.json
diff --git a/packages/activemq/data_stream/log/_dev/test/pipeline/test-activemq-6-2.log b/packages/activemq/data_stream/log/_dev/test/pipeline/test-activemq-6-2.log
new file mode 100644
index 00000000000..36cc98b47a1
--- /dev/null
+++ b/packages/activemq/data_stream/log/_dev/test/pipeline/test-activemq-6-2.log
@@ -0,0 +1,94 @@
+2026-04-15 22:27:39,190 | INFO  | Using Persistence Adapter: KahaDBPersistenceAdapter[/opt/activemq/data/kahadb] | org.apache.activemq.broker.BrokerService | main
+2026-04-15 22:27:39,198 | INFO  | Starting Persistence Adapter: KahaDBPersistenceAdapter[/opt/activemq/data/kahadb] | org.apache.activemq.broker.BrokerService | main
+2026-04-15 22:27:39,225 | INFO  | Starting KahaDBStore | org.apache.activemq.store.kahadb.KahaDBStore | main
+2026-04-15 22:27:39,227 | INFO  | Opening MessageDatabase | org.apache.activemq.store.kahadb.MessageDatabase | main
+2026-04-15 22:27:39,649 | INFO  | Starting Temp Data Store | org.apache.activemq.broker.BrokerService | main
+2026-04-15 22:27:39,650 | INFO  | PListStore:[/opt/activemq/data/localhost/tmp_storage] started | org.apache.activemq.store.kahadb.plist.PListStoreImpl | main
+2026-04-15 22:27:39,651 | INFO  | Starting Job Scheduler Store | org.apache.activemq.broker.BrokerService | main
+2026-04-15 22:27:39,651 | INFO  | Persistence Adapter successfully started | org.apache.activemq.broker.BrokerService | main
+2026-04-15 22:27:39,833 | INFO  | Apache ActiveMQ 6.2.2 (localhost, ID:localhost-46379-1776292059672-0:1) is starting | org.apache.activemq.broker.BrokerService | main
+2026-04-15 22:27:39,884 | INFO  | Listening for connections at: tcp://localhost:61616?maximumConnections=1000&wireFormat.maxFrameSize=104857600 | org.apache.activemq.transport.TransportServerThreadSupport | main
+2026-04-15 22:27:39,891 | INFO  | Connector openwire started | org.apache.activemq.broker.TransportConnector | main
+2026-04-15 22:27:39,917 | INFO  | Listening for connections at: amqp://localhost:5672?maximumConnections=1000&wireFormat.maxFrameSize=104857600 | org.apache.activemq.transport.TransportServerThreadSupport | main
+2026-04-15 22:27:39,921 | INFO  | Connector amqp started | org.apache.activemq.broker.TransportConnector | main
+2026-04-15 22:27:39,943 | INFO  | Listening for connections at: stomp://localhost:61613?maximumConnections=1000&wireFormat.maxFrameSize=104857600 | org.apache.activemq.transport.TransportServerThreadSupport | main
+2026-04-15 22:27:39,944 | INFO  | Connector stomp started | org.apache.activemq.broker.TransportConnector | main
+2026-04-15 22:27:39,954 | INFO  | Listening for connections at: mqtt://localhost:1883?maximumConnections=1000&wireFormat.maxFrameSize=104857600 | org.apache.activemq.transport.TransportServerThreadSupport | main
+2026-04-15 22:27:39,957 | INFO  | Connector mqtt started | org.apache.activemq.broker.TransportConnector | main
+2026-04-15 22:27:39,972 | INFO  | Starting Jetty server | org.apache.activemq.transport.WebTransportServerSupport | main
+2026-04-15 22:27:40,053 | INFO  | Creating Jetty connector | org.apache.activemq.transport.WebTransportServerSupport | main
+2026-04-15 22:27:40,420 | INFO  | Listening for connections at ws://localhost:61614?maximumConnections=1000&wireFormat.maxFrameSize=104857600 | org.apache.activemq.transport.ws.WSTransportServer | main
+2026-04-15 22:27:40,420 | INFO  | Connector ws started | org.apache.activemq.broker.TransportConnector | main
+2026-04-15 22:27:40,421 | INFO  | Apache ActiveMQ 6.2.2 (localhost, ID:localhost-46379-1776292059672-0:1) started | org.apache.activemq.broker.BrokerService | main
+2026-04-15 22:27:40,421 | INFO  | For help or more information please see: http://activemq.apache.org | org.apache.activemq.broker.BrokerService | main
+2026-04-15 22:27:40,434 | WARN  | Store limit is 102400 mb (current store usage is 0 mb). The data directory: /opt/activemq/data/kahadb only has 81977 mb of usable space. - resetting to maximum available disk space: 81977 mb | org.apache.activemq.broker.BrokerService | main
+2026-04-15 22:27:41,286 | WARN  | BaseResource file:///opt/apache-activemq-6.2.2/webapps/admin/ is aliased to null in o.e.j.w.WebAppContext@31e2232f{/admin,file:///opt/apache-activemq-6.2.2/webapps/admin/,STOPPED}. May not be supported in future releases. | org.eclipse.jetty.server.handler.ContextHandler | main
+2026-04-15 22:27:43,128 | INFO  | ActiveMQ WebConsole available at http://0.0.0.0:8161/ | org.apache.activemq.web.WebConsoleStarter | main
+2026-04-15 22:27:43,130 | INFO  | ActiveMQ Jolokia REST API available at http://0.0.0.0:8161/api/jolokia/ | org.apache.activemq.web.WebConsoleStarter | main
+2026-04-15 22:27:43,504 | WARN  | BaseResource file:///opt/apache-activemq-6.2.2/webapps/api/ is aliased to null in o.e.j.w.WebAppContext@3dc40ab9{/api,file:///opt/apache-activemq-6.2.2/webapps/api/,STOPPED}. May not be supported in future releases. | org.eclipse.jetty.server.handler.ContextHandler | main
+2026-04-15 22:27:44,733 | INFO  | Connector vm://localhost started | org.apache.activemq.broker.TransportConnector | qtp2064787513-43
+2026-04-15 22:29:09,022 | WARN  | No mapping for GET /admin/index.action | org.springframework.web.servlet.PageNotFound | qtp2064787513-43
+2026-04-15 22:29:09,040 | WARN  | /admin/index.action | org.eclipse.jetty.server.HttpChannel | qtp2064787513-43
+jakarta.servlet.ServletException: jakarta.servlet.ServletException: org.springframework.web.servlet.NoHandlerFoundException: No endpoint GET /admin/index.action.
+	at org.eclipse.jetty.server.handler.HandlerCollection.handle(HandlerCollection.java:157)
+	at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:122)
+	at org.eclipse.jetty.server.Server.handle(Server.java:563)
+	at org.eclipse.jetty.server.HttpChannel$RequestDispatchable.dispatch(HttpChannel.java:1598)
+	at org.eclipse.jetty.server.HttpChannel.dispatch(HttpChannel.java:753)
+	at org.eclipse.jetty.server.HttpChannel.handle(HttpChannel.java:501)
+	at org.eclipse.jetty.server.HttpConnection.onFillable(HttpConnection.java:287)
+	at org.eclipse.jetty.io.AbstractConnection$ReadCallback.succeeded(AbstractConnection.java:314)
+	at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:100)
+	at org.eclipse.jetty.io.SelectableChannelEndPoint$1.run(SelectableChannelEndPoint.java:53)
+	at org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.runTask(AdaptiveExecutionStrategy.java:421)
+	at org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.consumeTask(AdaptiveExecutionStrategy.java:390)
+	at org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.tryProduce(AdaptiveExecutionStrategy.java:277)
+	at org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.run(AdaptiveExecutionStrategy.java:199)
+	at org.eclipse.jetty.util.thread.ReservedThreadExecutor$ReservedThread.run(ReservedThreadExecutor.java:411)
+	at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:969)
+	at org.eclipse.jetty.util.thread.QueuedThreadPool$Runner.doRunJob(QueuedThreadPool.java:1194)
+	at org.eclipse.jetty.util.thread.QueuedThreadPool$Runner.run(QueuedThreadPool.java:1149)
+	at java.base/java.lang.Thread.run(Unknown Source)
+Caused by: jakarta.servlet.ServletException: org.springframework.web.servlet.NoHandlerFoundException: No endpoint GET /admin/index.action.
+	at org.eclipse.jetty.server.handler.HandlerCollection.handle(HandlerCollection.java:157)
+	at org.eclipse.jetty.security.SecurityHandler.handle(SecurityHandler.java:558)
+	at org.eclipse.jetty.server.handler.HandlerCollection.handle(HandlerCollection.java:141)
+	... 18 more
+Caused by: org.springframework.web.servlet.NoHandlerFoundException: No endpoint GET /admin/index.action.
+	at org.springframework.web.servlet.DispatcherServlet.noHandlerFound(DispatcherServlet.java:1305)
+	at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:1067)
+	at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:979)
+	at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:1014)
+	at org.springframework.web.servlet.FrameworkServlet.doGet(FrameworkServlet.java:903)
+	at jakarta.servlet.http.HttpServlet.service(HttpServlet.java:500)
+	at org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:885)
+	at jakarta.servlet.http.HttpServlet.service(HttpServlet.java:587)
+	at org.eclipse.jetty.servlet.ServletHolder$NotAsync.service(ServletHolder.java:1419)
+	at org.eclipse.jetty.servlet.ServletHolder.handle(ServletHolder.java:764)
+	at org.eclipse.jetty.servlet.ServletHandler$ChainEnd.doFilter(ServletHandler.java:1665)
+	at org.apache.activemq.web.AuditFilter.doFilter(AuditFilter.java:59)
+	at org.eclipse.jetty.servlet.FilterHolder.doFilter(FilterHolder.java:202)
+	at org.eclipse.jetty.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1635)
+	at org.springframework.web.filter.RequestContextFilter.doFilterInternal(RequestContextFilter.java:100)
+	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116)
+	at org.eclipse.jetty.servlet.FilterHolder.doFilter(FilterHolder.java:202)
+	at org.eclipse.jetty.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1635)
+	at org.apache.activemq.web.filter.ApplicationContextFilter.doFilter(ApplicationContextFilter.java:102)
+	at org.eclipse.jetty.servlet.FilterHolder.doFilter(FilterHolder.java:210)
+	at org.eclipse.jetty.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1635)
+	at org.eclipse.jetty.servlet.ServletHandler.doHandle(ServletHandler.java:527)
+	at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:131)
+	at org.eclipse.jetty.security.SecurityHandler.handle(SecurityHandler.java:558)
+	at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:122)
+	at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:223)
+	at org.eclipse.jetty.server.session.SessionHandler.doHandle(SessionHandler.java:1580)
+	at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:221)
+	at org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1381)
+	at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:176)
+	at org.eclipse.jetty.servlet.ServletHandler.doScope(ServletHandler.java:484)
+	at org.eclipse.jetty.server.session.SessionHandler.doScope(SessionHandler.java:1553)
+	at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:174)
+	at org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:1303)
+	at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:129)
+	at org.eclipse.jetty.server.handler.HandlerCollection.handle(HandlerCollection.java:141)
+	... 20 more
diff --git a/packages/activemq/data_stream/log/_dev/test/pipeline/test-activemq-6-2.log-expected.json b/packages/activemq/data_stream/log/_dev/test/pipeline/test-activemq-6-2.log-expected.json
new file mode 100644
index 00000000000..cadaaf1b89f
--- /dev/null
+++ b/packages/activemq/data_stream/log/_dev/test/pipeline/test-activemq-6-2.log-expected.json
@@ -0,0 +1,875 @@
+{
+    "expected": [
+        {
+            "@timestamp": "2026-04-15T22:27:39.190Z",
+            "activemq": {
+                "log": {
+                    "caller": "org.apache.activemq.broker.BrokerService",
+                    "thread": "main"
+                }
+            },
+            "ecs": {
+                "version": "8.11.0"
+            },
+            "event": {
+                "ingested": "2026-04-15T22:31:37.192652501Z",
+                "kind": "event",
+                "module": "activemq",
+                "original": "2026-04-15 22:27:39,190 | INFO  | Using Persistence Adapter: KahaDBPersistenceAdapter[/opt/activemq/data/kahadb] | org.apache.activemq.broker.BrokerService | main",
+                "type": [
+                    "info"
+                ]
+            },
+            "log": {
+                "level": "INFO"
+            },
+            "message": "Using Persistence Adapter: KahaDBPersistenceAdapter[/opt/activemq/data/kahadb]",
+            "tags": [
+                "preserve_original_event"
+            ]
+        },
+        {
+            "@timestamp": "2026-04-15T22:27:39.198Z",
+            "activemq": {
+                "log": {
+                    "caller": "org.apache.activemq.broker.BrokerService",
+                    "thread": "main"
+                }
+            },
+            "ecs": {
+                "version": "8.11.0"
+            },
+            "event": {
+                "ingested": "2026-04-15T22:31:37.192673514Z",
+                "kind": "event",
+                "module": "activemq",
+                "original": "2026-04-15 22:27:39,198 | INFO  | Starting Persistence Adapter: KahaDBPersistenceAdapter[/opt/activemq/data/kahadb] | org.apache.activemq.broker.BrokerService | main",
+                "type": [
+                    "info"
+                ]
+            },
+            "log": {
+                "level": "INFO"
+            },
+            "message": "Starting Persistence Adapter: KahaDBPersistenceAdapter[/opt/activemq/data/kahadb]",
+            "tags": [
+                "preserve_original_event"
+            ]
+        },
+        {
+            "@timestamp": "2026-04-15T22:27:39.225Z",
+            "activemq": {
+                "log": {
+                    "caller": "org.apache.activemq.store.kahadb.KahaDBStore",
+                    "thread": "main"
+                }
+            },
+            "ecs": {
+                "version": "8.11.0"
+            },
+            "event": {
+                "ingested": "2026-04-15T22:31:37.192683004Z",
+                "kind": "event",
+                "module": "activemq",
+                "original": "2026-04-15 22:27:39,225 | INFO  | Starting KahaDBStore | org.apache.activemq.store.kahadb.KahaDBStore | main",
+                "type": [
+                    "info"
+                ]
+            },
+            "log": {
+                "level": "INFO"
+            },
+            "message": "Starting KahaDBStore",
+            "tags": [
+                "preserve_original_event"
+            ]
+        },
+        {
+            "@timestamp": "2026-04-15T22:27:39.227Z",
+            "activemq": {
+                "log": {
+                    "caller": "org.apache.activemq.store.kahadb.MessageDatabase",
+                    "thread": "main"
+                }
+            },
+            "ecs": {
+                "version": "8.11.0"
+            },
+            "event": {
+                "ingested": "2026-04-15T22:31:37.192685716Z",
+                "kind": "event",
+                "module": "activemq",
+                "original": "2026-04-15 22:27:39,227 | INFO  | Opening MessageDatabase | org.apache.activemq.store.kahadb.MessageDatabase | main",
+                "type": [
+                    "info"
+                ]
+            },
+            "log": {
+                "level": "INFO"
+            },
+            "message": "Opening MessageDatabase",
+            "tags": [
+                "preserve_original_event"
+            ]
+        },
+        {
+            "@timestamp": "2026-04-15T22:27:39.649Z",
+            "activemq": {
+                "log": {
+                    "caller": "org.apache.activemq.broker.BrokerService",
+                    "thread": "main"
+                }
+            },
+            "ecs": {
+                "version": "8.11.0"
+            },
+            "event": {
+                "ingested": "2026-04-15T22:31:37.192687156Z",
+                "kind": "event",
+                "module": "activemq",
+                "original": "2026-04-15 22:27:39,649 | INFO  | Starting Temp Data Store | org.apache.activemq.broker.BrokerService | main",
+                "type": [
+                    "info"
+                ]
+            },
+            "log": {
+                "level": "INFO"
+            },
+            "message": "Starting Temp Data Store",
+            "tags": [
+                "preserve_original_event"
+            ]
+        },
+        {
+            "@timestamp": "2026-04-15T22:27:39.650Z",
+            "activemq": {
+                "log": {
+                    "caller": "org.apache.activemq.store.kahadb.plist.PListStoreImpl",
+                    "thread": "main"
+                }
+            },
+            "ecs": {
+                "version": "8.11.0"
+            },
+            "event": {
+                "ingested": "2026-04-15T22:31:37.192688639Z",
+                "kind": "event",
+                "module": "activemq",
+                "original": "2026-04-15 22:27:39,650 | INFO  | PListStore:[/opt/activemq/data/localhost/tmp_storage] started | org.apache.activemq.store.kahadb.plist.PListStoreImpl | main",
+                "type": [
+                    "info"
+                ]
+            },
+            "log": {
+                "level": "INFO"
+            },
+            "message": "PListStore:[/opt/activemq/data/localhost/tmp_storage] started",
+            "tags": [
+                "preserve_original_event"
+            ]
+        },
+        {
+            "@timestamp": "2026-04-15T22:27:39.651Z",
+            "activemq": {
+                "log": {
+                    "caller": "org.apache.activemq.broker.BrokerService",
+                    "thread": "main"
+                }
+            },
+            "ecs": {
+                "version": "8.11.0"
+            },
+            "event": {
+                "ingested": "2026-04-15T22:31:37.192695121Z",
+                "kind": "event",
+                "module": "activemq",
+                "original": "2026-04-15 22:27:39,651 | INFO  | Starting Job Scheduler Store | org.apache.activemq.broker.BrokerService | main",
+                "type": [
+                    "info"
+                ]
+            },
+            "log": {
+                "level": "INFO"
+            },
+            "message": "Starting Job Scheduler Store",
+            "tags": [
+                "preserve_original_event"
+            ]
+        },
+        {
+            "@timestamp": "2026-04-15T22:27:39.651Z",
+            "activemq": {
+                "log": {
+                    "caller": "org.apache.activemq.broker.BrokerService",
+                    "thread": "main"
+                }
+            },
+            "ecs": {
+                "version": "8.11.0"
+            },
+            "event": {
+                "ingested": "2026-04-15T22:31:37.192696477Z",
+                "kind": "event",
+                "module": "activemq",
+                "original": "2026-04-15 22:27:39,651 | INFO  | Persistence Adapter successfully started | org.apache.activemq.broker.BrokerService | main",
+                "type": [
+                    "info"
+                ]
+            },
+            "log": {
+                "level": "INFO"
+            },
+            "message": "Persistence Adapter successfully started",
+            "tags": [
+                "preserve_original_event"
+            ]
+        },
+        {
+            "@timestamp": "2026-04-15T22:27:39.833Z",
+            "activemq": {
+                "log": {
+                    "caller": "org.apache.activemq.broker.BrokerService",
+                    "thread": "main"
+                }
+            },
+            "ecs": {
+                "version": "8.11.0"
+            },
+            "event": {
+                "ingested": "2026-04-15T22:31:37.192697790Z",
+                "kind": "event",
+                "module": "activemq",
+                "original": "2026-04-15 22:27:39,833 | INFO  | Apache ActiveMQ 6.2.2 (localhost, ID:localhost-46379-1776292059672-0:1) is starting | org.apache.activemq.broker.BrokerService | main",
+                "type": [
+                    "info"
+                ]
+            },
+            "log": {
+                "level": "INFO"
+            },
+            "message": "Apache ActiveMQ 6.2.2 (localhost, ID:localhost-46379-1776292059672-0:1) is starting",
+            "tags": [
+                "preserve_original_event"
+            ]
+        },
+        {
+            "@timestamp": "2026-04-15T22:27:39.884Z",
+            "activemq": {
+                "log": {
+                    "caller": "org.apache.activemq.transport.TransportServerThreadSupport",
+                    "thread": "main"
+                }
+            },
+            "ecs": {
+                "version": "8.11.0"
+            },
+            "event": {
+                "ingested": "2026-04-15T22:31:37.192703594Z",
+                "kind": "event",
+                "module": "activemq",
+                "original": "2026-04-15 22:27:39,884 | INFO  | Listening for connections at: tcp://localhost:61616?maximumConnections=1000&wireFormat.maxFrameSize=104857600 | org.apache.activemq.transport.TransportServerThreadSupport | main",
+                "type": [
+                    "info"
+                ]
+            },
+            "log": {
+                "level": "INFO"
+            },
+            "message": "Listening for connections at: tcp://localhost:61616?maximumConnections=1000&wireFormat.maxFrameSize=104857600",
+            "tags": [
+                "preserve_original_event"
+            ]
+        },
+        {
+            "@timestamp": "2026-04-15T22:27:39.891Z",
+            "activemq": {
+                "log": {
+                    "caller": "org.apache.activemq.broker.TransportConnector",
+                    "thread": "main"
+                }
+            },
+            "ecs": {
+                "version": "8.11.0"
+            },
+            "event": {
+                "ingested": "2026-04-15T22:31:37.192704992Z",
+                "kind": "event",
+                "module": "activemq",
+                "original": "2026-04-15 22:27:39,891 | INFO  | Connector openwire started | org.apache.activemq.broker.TransportConnector | main",
+                "type": [
+                    "info"
+                ]
+            },
+            "log": {
+                "level": "INFO"
+            },
+            "message": "Connector openwire started",
+            "tags": [
+                "preserve_original_event"
+            ]
+        },
+        {
+            "@timestamp": "2026-04-15T22:27:39.917Z",
+            "activemq": {
+                "log": {
+                    "caller": "org.apache.activemq.transport.TransportServerThreadSupport",
+                    "thread": "main"
+                }
+            },
+            "ecs": {
+                "version": "8.11.0"
+            },
+            "event": {
+                "ingested": "2026-04-15T22:31:37.192706390Z",
+                "kind": "event",
+                "module": "activemq",
+                "original": "2026-04-15 22:27:39,917 | INFO  | Listening for connections at: amqp://localhost:5672?maximumConnections=1000&wireFormat.maxFrameSize=104857600 | org.apache.activemq.transport.TransportServerThreadSupport | main",
+                "type": [
+                    "info"
+                ]
+            },
+            "log": {
+                "level": "INFO"
+            },
+            "message": "Listening for connections at: amqp://localhost:5672?maximumConnections=1000&wireFormat.maxFrameSize=104857600",
+            "tags": [
+                "preserve_original_event"
+            ]
+        },
+        {
+            "@timestamp": "2026-04-15T22:27:39.921Z",
+            "activemq": {
+                "log": {
+                    "caller": "org.apache.activemq.broker.TransportConnector",
+                    "thread": "main"
+                }
+            },
+            "ecs": {
+                "version": "8.11.0"
+            },
+            "event": {
+                "ingested": "2026-04-15T22:31:37.192712703Z",
+                "kind": "event",
+                "module": "activemq",
+                "original": "2026-04-15 22:27:39,921 | INFO  | Connector amqp started | org.apache.activemq.broker.TransportConnector | main",
+                "type": [
+                    "info"
+                ]
+            },
+            "log": {
+                "level": "INFO"
+            },
+            "message": "Connector amqp started",
+            "tags": [
+                "preserve_original_event"
+            ]
+        },
+        {
+            "@timestamp": "2026-04-15T22:27:39.943Z",
+            "activemq": {
+                "log": {
+                    "caller": "org.apache.activemq.transport.TransportServerThreadSupport",
+                    "thread": "main"
+                }
+            },
+            "ecs": {
+                "version": "8.11.0"
+            },
+            "event": {
+                "ingested": "2026-04-15T22:31:37.192714185Z",
+                "kind": "event",
+                "module": "activemq",
+                "original": "2026-04-15 22:27:39,943 | INFO  | Listening for connections at: stomp://localhost:61613?maximumConnections=1000&wireFormat.maxFrameSize=104857600 | org.apache.activemq.transport.TransportServerThreadSupport | main",
+                "type": [
+                    "info"
+                ]
+            },
+            "log": {
+                "level": "INFO"
+            },
+            "message": "Listening for connections at: stomp://localhost:61613?maximumConnections=1000&wireFormat.maxFrameSize=104857600",
+            "tags": [
+                "preserve_original_event"
+            ]
+        },
+        {
+            "@timestamp": "2026-04-15T22:27:39.944Z",
+            "activemq": {
+                "log": {
+                    "caller": "org.apache.activemq.broker.TransportConnector",
+                    "thread": "main"
+                }
+            },
+            "ecs": {
+                "version": "8.11.0"
+            },
+            "event": {
+                "ingested": "2026-04-15T22:31:37.192715456Z",
+                "kind": "event",
+                "module": "activemq",
+                "original": "2026-04-15 22:27:39,944 | INFO  | Connector stomp started | org.apache.activemq.broker.TransportConnector | main",
+                "type": [
+                    "info"
+                ]
+            },
+            "log": {
+                "level": "INFO"
+            },
+            "message": "Connector stomp started",
+            "tags": [
+                "preserve_original_event"
+            ]
+        },
+        {
+            "@timestamp": "2026-04-15T22:27:39.954Z",
+            "activemq": {
+                "log": {
+                    "caller": "org.apache.activemq.transport.TransportServerThreadSupport",
+                    "thread": "main"
+                }
+            },
+            "ecs": {
+                "version": "8.11.0"
+            },
+            "event": {
+                "ingested": "2026-04-15T22:31:37.192722701Z",
+                "kind": "event",
+                "module": "activemq",
+                "original": "2026-04-15 22:27:39,954 | INFO  | Listening for connections at: mqtt://localhost:1883?maximumConnections=1000&wireFormat.maxFrameSize=104857600 | org.apache.activemq.transport.TransportServerThreadSupport | main",
+                "type": [
+                    "info"
+                ]
+            },
+            "log": {
+                "level": "INFO"
+            },
+            "message": "Listening for connections at: mqtt://localhost:1883?maximumConnections=1000&wireFormat.maxFrameSize=104857600",
+            "tags": [
+                "preserve_original_event"
+            ]
+        },
+        {
+            "@timestamp": "2026-04-15T22:27:39.957Z",
+            "activemq": {
+                "log": {
+                    "caller": "org.apache.activemq.broker.TransportConnector",
+                    "thread": "main"
+                }
+            },
+            "ecs": {
+                "version": "8.11.0"
+            },
+            "event": {
+                "ingested": "2026-04-15T22:31:37.192724184Z",
+                "kind": "event",
+                "module": "activemq",
+                "original": "2026-04-15 22:27:39,957 | INFO  | Connector mqtt started | org.apache.activemq.broker.TransportConnector | main",
+                "type": [
+                    "info"
+                ]
+            },
+            "log": {
+                "level": "INFO"
+            },
+            "message": "Connector mqtt started",
+            "tags": [
+                "preserve_original_event"
+            ]
+        },
+        {
+            "@timestamp": "2026-04-15T22:27:39.972Z",
+            "activemq": {
+                "log": {
+                    "caller": "org.apache.activemq.transport.WebTransportServerSupport",
+                    "thread": "main"
+                }
+            },
+            "ecs": {
+                "version": "8.11.0"
+            },
+            "event": {
+                "ingested": "2026-04-15T22:31:37.192725539Z",
+                "kind": "event",
+                "module": "activemq",
+                "original": "2026-04-15 22:27:39,972 | INFO  | Starting Jetty server | org.apache.activemq.transport.WebTransportServerSupport | main",
+                "type": [
+                    "info"
+                ]
+            },
+            "log": {
+                "level": "INFO"
+            },
+            "message": "Starting Jetty server",
+            "tags": [
+                "preserve_original_event"
+            ]
+        },
+        {
+            "@timestamp": "2026-04-15T22:27:40.053Z",
+            "activemq": {
+                "log": {
+                    "caller": "org.apache.activemq.transport.WebTransportServerSupport",
+                    "thread": "main"
+                }
+            },
+            "ecs": {
+                "version": "8.11.0"
+            },
+            "event": {
+                "ingested": "2026-04-15T22:31:37.192731089Z",
+                "kind": "event",
+                "module": "activemq",
+                "original": "2026-04-15 22:27:40,053 | INFO  | Creating Jetty connector | org.apache.activemq.transport.WebTransportServerSupport | main",
+                "type": [
+                    "info"
+                ]
+            },
+            "log": {
+                "level": "INFO"
+            },
+            "message": "Creating Jetty connector",
+            "tags": [
+                "preserve_original_event"
+            ]
+        },
+        {
+            "@timestamp": "2026-04-15T22:27:40.420Z",
+            "activemq": {
+                "log": {
+                    "caller": "org.apache.activemq.transport.ws.WSTransportServer",
+                    "thread": "main"
+                }
+            },
+            "ecs": {
+                "version": "8.11.0"
+            },
+            "event": {
+                "ingested": "2026-04-15T22:31:37.192732615Z",
+                "kind": "event",
+                "module": "activemq",
+                "original": "2026-04-15 22:27:40,420 | INFO  | Listening for connections at ws://localhost:61614?maximumConnections=1000&wireFormat.maxFrameSize=104857600 | org.apache.activemq.transport.ws.WSTransportServer | main",
+                "type": [
+                    "info"
+                ]
+            },
+            "log": {
+                "level": "INFO"
+            },
+            "message": "Listening for connections at ws://localhost:61614?maximumConnections=1000&wireFormat.maxFrameSize=104857600",
+            "tags": [
+                "preserve_original_event"
+            ]
+        },
+        {
+            "@timestamp": "2026-04-15T22:27:40.420Z",
+            "activemq": {
+                "log": {
+                    "caller": "org.apache.activemq.broker.TransportConnector",
+                    "thread": "main"
+                }
+            },
+            "ecs": {
+                "version": "8.11.0"
+            },
+            "event": {
+                "ingested": "2026-04-15T22:31:37.192733843Z",
+                "kind": "event",
+                "module": "activemq",
+                "original": "2026-04-15 22:27:40,420 | INFO  | Connector ws started | org.apache.activemq.broker.TransportConnector | main",
+                "type": [
+                    "info"
+                ]
+            },
+            "log": {
+                "level": "INFO"
+            },
+            "message": "Connector ws started",
+            "tags": [
+                "preserve_original_event"
+            ]
+        },
+        {
+            "@timestamp": "2026-04-15T22:27:40.421Z",
+            "activemq": {
+                "log": {
+                    "caller": "org.apache.activemq.broker.BrokerService",
+                    "thread": "main"
+                }
+            },
+            "ecs": {
+                "version": "8.11.0"
+            },
+            "event": {
+                "ingested": "2026-04-15T22:31:37.192735241Z",
+                "kind": "event",
+                "module": "activemq",
+                "original": "2026-04-15 22:27:40,421 | INFO  | Apache ActiveMQ 6.2.2 (localhost, ID:localhost-46379-1776292059672-0:1) started | org.apache.activemq.broker.BrokerService | main",
+                "type": [
+                    "info"
+                ]
+            },
+            "log": {
+                "level": "INFO"
+            },
+            "message": "Apache ActiveMQ 6.2.2 (localhost, ID:localhost-46379-1776292059672-0:1) started",
+            "tags": [
+                "preserve_original_event"
+            ]
+        },
+        {
+            "@timestamp": "2026-04-15T22:27:40.421Z",
+            "activemq": {
+                "log": {
+                    "caller": "org.apache.activemq.broker.BrokerService",
+                    "thread": "main"
+                }
+            },
+            "ecs": {
+                "version": "8.11.0"
+            },
+            "event": {
+                "ingested": "2026-04-15T22:31:37.192742825Z",
+                "kind": "event",
+                "module": "activemq",
+                "original": "2026-04-15 22:27:40,421 | INFO  | For help or more information please see: http://activemq.apache.org | org.apache.activemq.broker.BrokerService | main",
+                "type": [
+                    "info"
+                ]
+            },
+            "log": {
+                "level": "INFO"
+            },
+            "message": "For help or more information please see: http://activemq.apache.org",
+            "tags": [
+                "preserve_original_event"
+            ]
+        },
+        {
+            "@timestamp": "2026-04-15T22:27:40.434Z",
+            "activemq": {
+                "log": {
+                    "caller": "org.apache.activemq.broker.BrokerService",
+                    "thread": "main"
+                }
+            },
+            "ecs": {
+                "version": "8.11.0"
+            },
+            "event": {
+                "ingested": "2026-04-15T22:31:37.192744138Z",
+                "kind": "event",
+                "module": "activemq",
+                "original": "2026-04-15 22:27:40,434 | WARN  | Store limit is 102400 mb (current store usage is 0 mb). The data directory: /opt/activemq/data/kahadb only has 81977 mb of usable space. - resetting to maximum available disk space: 81977 mb | org.apache.activemq.broker.BrokerService | main",
+                "type": [
+                    "error"
+                ]
+            },
+            "log": {
+                "level": "WARN"
+            },
+            "message": "Store limit is 102400 mb (current store usage is 0 mb). The data directory: /opt/activemq/data/kahadb only has 81977 mb of usable space. - resetting to maximum available disk space: 81977 mb",
+            "tags": [
+                "preserve_original_event"
+            ]
+        },
+        {
+            "@timestamp": "2026-04-15T22:27:41.286Z",
+            "activemq": {
+                "log": {
+                    "caller": "org.eclipse.jetty.server.handler.ContextHandler",
+                    "thread": "main"
+                }
+            },
+            "ecs": {
+                "version": "8.11.0"
+            },
+            "event": {
+                "ingested": "2026-04-15T22:31:37.192745409Z",
+                "kind": "event",
+                "module": "activemq",
+                "original": "2026-04-15 22:27:41,286 | WARN  | BaseResource file:///opt/apache-activemq-6.2.2/webapps/admin/ is aliased to null in o.e.j.w.WebAppContext@31e2232f{/admin,file:///opt/apache-activemq-6.2.2/webapps/admin/,STOPPED}. May not be supported in future releases. | org.eclipse.jetty.server.handler.ContextHandler | main",
+                "type": [
+                    "error"
+                ]
+            },
+            "log": {
+                "level": "WARN"
+            },
+            "message": "BaseResource file:///opt/apache-activemq-6.2.2/webapps/admin/ is aliased to null in o.e.j.w.WebAppContext@31e2232f{/admin,file:///opt/apache-activemq-6.2.2/webapps/admin/,STOPPED}. May not be supported in future releases.",
+            "tags": [
+                "preserve_original_event"
+            ]
+        },
+        {
+            "@timestamp": "2026-04-15T22:27:43.128Z",
+            "activemq": {
+                "log": {
+                    "caller": "org.apache.activemq.web.WebConsoleStarter",
+                    "thread": "main"
+                }
+            },
+            "ecs": {
+                "version": "8.11.0"
+            },
+            "event": {
+                "ingested": "2026-04-15T22:31:37.192751891Z",
+                "kind": "event",
+                "module": "activemq",
+                "original": "2026-04-15 22:27:43,128 | INFO  | ActiveMQ WebConsole available at http://0.0.0.0:8161/ | org.apache.activemq.web.WebConsoleStarter | main",
+                "type": [
+                    "info"
+                ]
+            },
+            "log": {
+                "level": "INFO"
+            },
+            "message": "ActiveMQ WebConsole available at http://0.0.0.0:8161/",
+            "tags": [
+                "preserve_original_event"
+            ]
+        },
+        {
+            "@timestamp": "2026-04-15T22:27:43.130Z",
+            "activemq": {
+                "log": {
+                    "caller": "org.apache.activemq.web.WebConsoleStarter",
+                    "thread": "main"
+                }
+            },
+            "ecs": {
+                "version": "8.11.0"
+            },
+            "event": {
+                "ingested": "2026-04-15T22:31:37.192753162Z",
+                "kind": "event",
+                "module": "activemq",
+                "original": "2026-04-15 22:27:43,130 | INFO  | ActiveMQ Jolokia REST API available at http://0.0.0.0:8161/api/jolokia/ | org.apache.activemq.web.WebConsoleStarter | main",
+                "type": [
+                    "info"
+                ]
+            },
+            "log": {
+                "level": "INFO"
+            },
+            "message": "ActiveMQ Jolokia REST API available at http://0.0.0.0:8161/api/jolokia/",
+            "tags": [
+                "preserve_original_event"
+            ]
+        },
+        {
+            "@timestamp": "2026-04-15T22:27:43.504Z",
+            "activemq": {
+                "log": {
+                    "caller": "org.eclipse.jetty.server.handler.ContextHandler",
+                    "thread": "main"
+                }
+            },
+            "ecs": {
+                "version": "8.11.0"
+            },
+            "event": {
+                "ingested": "2026-04-15T22:31:37.192754433Z",
+                "kind": "event",
+                "module": "activemq",
+                "original": "2026-04-15 22:27:43,504 | WARN  | BaseResource file:///opt/apache-activemq-6.2.2/webapps/api/ is aliased to null in o.e.j.w.WebAppContext@3dc40ab9{/api,file:///opt/apache-activemq-6.2.2/webapps/api/,STOPPED}. May not be supported in future releases. | org.eclipse.jetty.server.handler.ContextHandler | main",
+                "type": [
+                    "error"
+                ]
+            },
+            "log": {
+                "level": "WARN"
+            },
+            "message": "BaseResource file:///opt/apache-activemq-6.2.2/webapps/api/ is aliased to null in o.e.j.w.WebAppContext@3dc40ab9{/api,file:///opt/apache-activemq-6.2.2/webapps/api/,STOPPED}. May not be supported in future releases.",
+            "tags": [
+                "preserve_original_event"
+            ]
+        },
+        {
+            "@timestamp": "2026-04-15T22:27:44.733Z",
+            "activemq": {
+                "log": {
+                    "caller": "org.apache.activemq.broker.TransportConnector",
+                    "thread": "qtp2064787513-43"
+                }
+            },
+            "ecs": {
+                "version": "8.11.0"
+            },
+            "event": {
+                "ingested": "2026-04-15T22:31:37.192761720Z",
+                "kind": "event",
+                "module": "activemq",
+                "original": "2026-04-15 22:27:44,733 | INFO  | Connector vm://localhost started | org.apache.activemq.broker.TransportConnector | qtp2064787513-43",
+                "type": [
+                    "info"
+                ]
+            },
+            "log": {
+                "level": "INFO"
+            },
+            "message": "Connector vm://localhost started",
+            "tags": [
+                "preserve_original_event"
+            ]
+        },
+        {
+            "@timestamp": "2026-04-15T22:29:09.022Z",
+            "activemq": {
+                "log": {
+                    "caller": "org.springframework.web.servlet.PageNotFound",
+                    "thread": "qtp2064787513-43"
+                }
+            },
+            "ecs": {
+                "version": "8.11.0"
+            },
+            "event": {
+                "ingested": "2026-04-15T22:31:37.192763075Z",
+                "kind": "event",
+                "module": "activemq",
+                "original": "2026-04-15 22:29:09,022 | WARN  | No mapping for GET /admin/index.action | org.springframework.web.servlet.PageNotFound | qtp2064787513-43",
+                "type": [
+                    "error"
+                ]
+            },
+            "log": {
+                "level": "WARN"
+            },
+            "message": "No mapping for GET /admin/index.action",
+            "tags": [
+                "preserve_original_event"
+            ]
+        },
+        {
+            "@timestamp": "2026-04-15T22:29:09.040Z",
+            "activemq": {
+                "log": {
+                    "caller": "org.eclipse.jetty.server.HttpChannel",
+                    "thread": "qtp2064787513-43"
+                }
+            },
+            "ecs": {
+                "version": "8.11.0"
+            },
+            "error": {
+                "stack_trace": "jakarta.servlet.ServletException: jakarta.servlet.ServletException: org.springframework.web.servlet.NoHandlerFoundException: No endpoint GET /admin/index.action.\n\tat org.eclipse.jetty.server.handler.HandlerCollection.handle(HandlerCollection.java:157)\n\tat org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:122)\n\tat org.eclipse.jetty.server.Server.handle(Server.java:563)\n\tat org.eclipse.jetty.server.HttpChannel$RequestDispatchable.dispatch(HttpChannel.java:1598)\n\tat org.eclipse.jetty.server.HttpChannel.dispatch(HttpChannel.java:753)\n\tat org.eclipse.jetty.server.HttpChannel.handle(HttpChannel.java:501)\n\tat org.eclipse.jetty.server.HttpConnection.onFillable(HttpConnection.java:287)\n\tat org.eclipse.jetty.io.AbstractConnection$ReadCallback.succeeded(AbstractConnection.java:314)\n\tat org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:100)\n\tat org.eclipse.jetty.io.SelectableChannelEndPoint$1.run(SelectableChannelEndPoint.java:53)\n\tat org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.runTask(AdaptiveExecutionStrategy.java:421)\n\tat org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.consumeTask(AdaptiveExecutionStrategy.java:390)\n\tat org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.tryProduce(AdaptiveExecutionStrategy.java:277)\n\tat org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.run(AdaptiveExecutionStrategy.java:199)\n\tat org.eclipse.jetty.util.thread.ReservedThreadExecutor$ReservedThread.run(ReservedThreadExecutor.java:411)\n\tat org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:969)\n\tat org.eclipse.jetty.util.thread.QueuedThreadPool$Runner.doRunJob(QueuedThreadPool.java:1194)\n\tat org.eclipse.jetty.util.thread.QueuedThreadPool$Runner.run(QueuedThreadPool.java:1149)\n\tat java.base/java.lang.Thread.run(Unknown Source)\nCaused by: jakarta.servlet.ServletException: org.springframework.web.servlet.NoHandlerFoundException: No endpoint GET /admin/index.action.\n\tat org.eclipse.jetty.server.handler.HandlerCollection.handle(HandlerCollection.java:157)\n\tat org.eclipse.jetty.security.SecurityHandler.handle(SecurityHandler.java:558)\n\tat org.eclipse.jetty.server.handler.HandlerCollection.handle(HandlerCollection.java:141)\n\t... 18 more\nCaused by: org.springframework.web.servlet.NoHandlerFoundException: No endpoint GET /admin/index.action.\n\tat org.springframework.web.servlet.DispatcherServlet.noHandlerFound(DispatcherServlet.java:1305)\n\tat org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:1067)\n\tat org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:979)\n\tat org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:1014)\n\tat org.springframework.web.servlet.FrameworkServlet.doGet(FrameworkServlet.java:903)\n\tat jakarta.servlet.http.HttpServlet.service(HttpServlet.java:500)\n\tat org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:885)\n\tat jakarta.servlet.http.HttpServlet.service(HttpServlet.java:587)\n\tat org.eclipse.jetty.servlet.ServletHolder$NotAsync.service(ServletHolder.java:1419)\n\tat org.eclipse.jetty.servlet.ServletHolder.handle(ServletHolder.java:764)\n\tat org.eclipse.jetty.servlet.ServletHandler$ChainEnd.doFilter(ServletHandler.java:1665)\n\tat org.apache.activemq.web.AuditFilter.doFilter(AuditFilter.java:59)\n\tat org.eclipse.jetty.servlet.FilterHolder.doFilter(FilterHolder.java:202)\n\tat org.eclipse.jetty.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1635)\n\tat org.springframework.web.filter.RequestContextFilter.doFilterInternal(RequestContextFilter.java:100)\n\tat org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116)\n\tat org.eclipse.jetty.servlet.FilterHolder.doFilter(FilterHolder.java:202)\n\tat org.eclipse.jetty.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1635)\n\tat org.apache.activemq.web.filter.ApplicationContextFilter.doFilter(ApplicationContextFilter.java:102)\n\tat org.eclipse.jetty.servlet.FilterHolder.doFilter(FilterHolder.java:210)\n\tat org.eclipse.jetty.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1635)\n\tat org.eclipse.jetty.servlet.ServletHandler.doHandle(ServletHandler.java:527)\n\tat org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:131)\n\tat org.eclipse.jetty.security.SecurityHandler.handle(SecurityHandler.java:558)\n\tat org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:122)\n\tat org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:223)\n\tat org.eclipse.jetty.server.session.SessionHandler.doHandle(SessionHandler.java:1580)\n\tat org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:221)\n\tat org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1381)\n\tat org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:176)\n\tat org.eclipse.jetty.servlet.ServletHandler.doScope(ServletHandler.java:484)\n\tat org.eclipse.jetty.server.session.SessionHandler.doScope(SessionHandler.java:1553)\n\tat org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:174)\n\tat org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:1303)\n\tat org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:129)\n\tat org.eclipse.jetty.server.handler.HandlerCollection.handle(HandlerCollection.java:141)\n\t... 20 more"
+            },
+            "event": {
+                "ingested": "2026-04-15T22:31:37.192764304Z",
+                "kind": "event",
+                "module": "activemq",
+                "original": "2026-04-15 22:29:09,040 | WARN  | /admin/index.action | org.eclipse.jetty.server.HttpChannel | qtp2064787513-43\njakarta.servlet.ServletException: jakarta.servlet.ServletException: org.springframework.web.servlet.NoHandlerFoundException: No endpoint GET /admin/index.action.\n\tat org.eclipse.jetty.server.handler.HandlerCollection.handle(HandlerCollection.java:157)\n\tat org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:122)\n\tat org.eclipse.jetty.server.Server.handle(Server.java:563)\n\tat org.eclipse.jetty.server.HttpChannel$RequestDispatchable.dispatch(HttpChannel.java:1598)\n\tat org.eclipse.jetty.server.HttpChannel.dispatch(HttpChannel.java:753)\n\tat org.eclipse.jetty.server.HttpChannel.handle(HttpChannel.java:501)\n\tat org.eclipse.jetty.server.HttpConnection.onFillable(HttpConnection.java:287)\n\tat org.eclipse.jetty.io.AbstractConnection$ReadCallback.succeeded(AbstractConnection.java:314)\n\tat org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:100)\n\tat org.eclipse.jetty.io.SelectableChannelEndPoint$1.run(SelectableChannelEndPoint.java:53)\n\tat org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.runTask(AdaptiveExecutionStrategy.java:421)\n\tat org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.consumeTask(AdaptiveExecutionStrategy.java:390)\n\tat org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.tryProduce(AdaptiveExecutionStrategy.java:277)\n\tat org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.run(AdaptiveExecutionStrategy.java:199)\n\tat org.eclipse.jetty.util.thread.ReservedThreadExecutor$ReservedThread.run(ReservedThreadExecutor.java:411)\n\tat org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:969)\n\tat org.eclipse.jetty.util.thread.QueuedThreadPool$Runner.doRunJob(QueuedThreadPool.java:1194)\n\tat org.eclipse.jetty.util.thread.QueuedThreadPool$Runner.run(QueuedThreadPool.java:1149)\n\tat java.base/java.lang.Thread.run(Unknown Source)\nCaused by: jakarta.servlet.ServletException: org.springframework.web.servlet.NoHandlerFoundException: No endpoint GET /admin/index.action.\n\tat org.eclipse.jetty.server.handler.HandlerCollection.handle(HandlerCollection.java:157)\n\tat org.eclipse.jetty.security.SecurityHandler.handle(SecurityHandler.java:558)\n\tat org.eclipse.jetty.server.handler.HandlerCollection.handle(HandlerCollection.java:141)\n\t... 18 more\nCaused by: org.springframework.web.servlet.NoHandlerFoundException: No endpoint GET /admin/index.action.\n\tat org.springframework.web.servlet.DispatcherServlet.noHandlerFound(DispatcherServlet.java:1305)\n\tat org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:1067)\n\tat org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:979)\n\tat org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:1014)\n\tat org.springframework.web.servlet.FrameworkServlet.doGet(FrameworkServlet.java:903)\n\tat jakarta.servlet.http.HttpServlet.service(HttpServlet.java:500)\n\tat org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:885)\n\tat jakarta.servlet.http.HttpServlet.service(HttpServlet.java:587)\n\tat org.eclipse.jetty.servlet.ServletHolder$NotAsync.service(ServletHolder.java:1419)\n\tat org.eclipse.jetty.servlet.ServletHolder.handle(ServletHolder.java:764)\n\tat org.eclipse.jetty.servlet.ServletHandler$ChainEnd.doFilter(ServletHandler.java:1665)\n\tat org.apache.activemq.web.AuditFilter.doFilter(AuditFilter.java:59)\n\tat org.eclipse.jetty.servlet.FilterHolder.doFilter(FilterHolder.java:202)\n\tat org.eclipse.jetty.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1635)\n\tat org.springframework.web.filter.RequestContextFilter.doFilterInternal(RequestContextFilter.java:100)\n\tat org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116)\n\tat org.eclipse.jetty.servlet.FilterHolder.doFilter(FilterHolder.java:202)\n\tat org.eclipse.jetty.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1635)\n\tat org.apache.activemq.web.filter.ApplicationContextFilter.doFilter(ApplicationContextFilter.java:102)\n\tat org.eclipse.jetty.servlet.FilterHolder.doFilter(FilterHolder.java:210)\n\tat org.eclipse.jetty.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1635)\n\tat org.eclipse.jetty.servlet.ServletHandler.doHandle(ServletHandler.java:527)\n\tat org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:131)\n\tat org.eclipse.jetty.security.SecurityHandler.handle(SecurityHandler.java:558)\n\tat org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:122)\n\tat org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:223)\n\tat org.eclipse.jetty.server.session.SessionHandler.doHandle(SessionHandler.java:1580)\n\tat org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:221)\n\tat org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1381)\n\tat org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:176)\n\tat org.eclipse.jetty.servlet.ServletHandler.doScope(ServletHandler.java:484)\n\tat org.eclipse.jetty.server.session.SessionHandler.doScope(SessionHandler.java:1553)\n\tat org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:174)\n\tat org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:1303)\n\tat org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:129)\n\tat org.eclipse.jetty.server.handler.HandlerCollection.handle(HandlerCollection.java:141)\n\t... 20 more",
+                "type": [
+                    "error"
+                ]
+            },
+            "log": {
+                "level": "WARN"
+            },
+            "message": "/admin/index.action",
+            "tags": [
+                "preserve_original_event"
+            ]
+        }
+    ]
+}
diff --git a/packages/activemq/docs/README.md b/packages/activemq/docs/README.md
index f034222ee9b..07ba255d8b6 100644
--- a/packages/activemq/docs/README.md
+++ b/packages/activemq/docs/README.md
@@ -30,7 +30,11 @@ Note:
 
 ## Compatibility
 
-This integration has been tested against ActiveMQ 5.17.1 (independent from the operating system).
+This integration targets **Apache ActiveMQ Classic**. Elastic package system tests can run against **ActiveMQ Classic 6.2.2** (default) or **5.17.1** (see `_dev/deploy/variants.yml`). Use a **Java 17 or newer** JVM in the test image; ActiveMQ Classic 6.2.x requires Java 17+ on the broker, and 5.17.x runs on Java 17 for these tests.
+
+Metrics are collected through the embedded **Jolokia** endpoint (Jolokia 2.x in ActiveMQ 6.2.x). The default path (`/api/jolokia/?ignoreErrors=true&canonicalNaming=false`) matches the web console `/api` context from the upstream distribution.
+
+Log and audit parsing follow the default log line formats described below, which match the pipeline test fixtures for this package.
 
 ## What do I need to use this integration?
 
diff --git a/packages/activemq/manifest.yml b/packages/activemq/manifest.yml
index f29d7d69956..eaa5e3f056a 100644
--- a/packages/activemq/manifest.yml
+++ b/packages/activemq/manifest.yml
@@ -1,6 +1,6 @@
 name: activemq
 title: ActiveMQ
-version: "1.9.0"
+version: "1.10.0"
 description: Collect logs and metrics from ActiveMQ instances with Elastic Agent.
 type: integration
 icons: