Parse Json

Elastic Stack Logstash
3

The same result, with "@timestamp" and "@version" which can be removed in the mutate remove_field list :

filter {
  grok { match => { "message" => [",\"uri\":\"%{DATA:method} %{DATA}\",\"http_status\":"]} }
	 
  mutate { remove_field => [ "event", "host", "message"] } 
}

The first version json/prune is better in case you decide to have all fields or change white_list.
The grok is simpler in case of you need only one field.