Logstash elasticsearch filter plugin

I'd check the document in ES to make sure that field is called what you want.