Hi @BDeveloper
Hmmm Ok, I / We do not "debug" 3rd party instructions... quick glance looks sorta ok... it also does not show you how to debug etc..etc... nothing in there about custom parsing etc. It's not the best / correct path if your Nginx logs are OOTB (there is an easier way). Yes, I understand yours are customized....
So Important Question
a) Do you WANT or NEED to run Logstash? If so Why?
or
B) Are you just running logstash because you think you need to because of the article?
Because you do not need to run logstash to ship and parse these files...
Log Files -> Filebeat -> (Parse with Ingest Pipeline Parse) Elasticsearch
or
Log Files -> Filebeat -> Parse Logstash -> Elasticsearch
Do you have a preference? Running Logstash adds another complexity... do you really need / want it?
Also you are showing at least 3 different formats so there will need to be at least 3 GROK parsers ... we can get to that after you answer the above question.