---

filter {
  # Обрабатываем только логи Nginx (поле app == "nginx")
  if [app] == "nginx" {
    grok {
      match => {
        "message" => "%{IP:client_ip} - - \[%{HTTPDATE:timestamp}\] \"%{WORD:method} %{URIPATHPARAM:path} HTTP/%{NUMBER:http_version}\" %{NUMBER:response} %{NUMBER:bytes} \"-\" %{QS:header}"
      }
    }

    date {
      match => ["timestamp", "dd/MMM/yyyy:HH:mm:ss Z"]
      target => "@timestamp"
      remove_field => ["timestamp"]
    }

    mutate {
      add_field => { "from_host" => "vm3" }
    }
  }
}