Please see below filter clause in config file,
filter {
grok {
match => [ "message", "%{TIMESTAMP_ISO8601:logTimestampString} \[%{WORD:logMode}\]: Server %{WORD:messageType}:%{GREEDYDATA:jsonObject}"]
}
json {
source => "jsonObject"
target => "doc"
}
if ([messageType] == "Request") {
date {
locale => "en"
match => ["logTimestampString", "YYYY-MM-dd HH:mm:ss"]
target => "requestLogTimestamp"
}
mutate {
add_field => {
"requestType" => "%{[doc][requestType]}"
}
}
}
else if ([messageType] == "Response"){
date {
locale => "en"
match => ["logTimestampString", "YYYY-MM-dd HH:mm:ss"]
target => "responseLogTimestamp"
}
if ([doc][message] != "success") {
mutate {
add_field => {
"ErrorMessage" => "%{[doc][reply][ErrorMessage]}"
}
}
}
mutate {
add_field => {
"messageStatus" => "%{[doc][message]}"
}
}
}
mutate {
add_field => {
"requestID" => "%{[doc][requestID]}"
}
remove_field => [ "jsonObject", "doc", "path", "logTimestampString", "reply", "request", "message"]
}
}