Give that a read, it'll get you most of the way there. As you will surmise, your conditional will need to be whatever field or array element holds your http method. I think mine are usually just [http][request][method], but you'll want to check your GROK strings to figure out how yours are stored.