Filter only required logs and send to elastic search

If you want to drop any message that does not contain the string "NAS" you could use

if "NAS" not in [message] { drop {} }

If you want to drop any event where [message] does not contain the word "NAS" you could use

if [message] !~ /\bNAS\b/ { drop {} }