input { pipeline { address => open_dmp_main } } filter { grok { match => { "message" => "(?%{DATE} %{TIME})%{SPACE}%{LOGLEVEL:level} %{NUMBER:pid} --- \[%{DATA:thread}\] %{DATA:class}%{SPACE}: %{GREEDYDATA:logmessage}" } } if "_grokparsefailure" not in [tags] { mutate { remove_field => [ "message" ] } } } output { pipeline { send_to => open_dmp_send_to_elastic } }