input { http { port => 31311 # default: 8080 } } filter { grok{ match => { "message" => "%{GREEDYDATA:request}"} } json{ source => "request" target => "parsed" } split{ field=>"entries" } } output { elasticsearch { hosts => [ 'elasticsearch' ] user => 'elastic' password => 'changeme' index => "data-management-plan-%{[entries][indexType]}-%{+YYYY.MM.dd}" } }