kv.conf

input {
	tcp {
		port => 5000
	}
}



filter {

	grok { 
	    	match => { "message" => "(?<pre>^.*)(?<cs6>cs6=)(?<cs6-value>.*)(?<post>src=.*$)" 
	    }
	 } 


	mutate {
		replace => { "message" => "%{pre} %{post}" }
    	}
	
	mutate {
		replace => { "cs6" => "%{cs6-value}" }
    	}


    	mutate {
		remove_field => ["pre","post","cs6-value"]
  	}

	mutate {
		gsub => ["message", "(\S+=)", "% \1"]
	}

	kv {
		field_split => "%"
		trim_key => " "
		trim_value => " "
	}


}



output {
	stdout { codec => rubydebug }
	elasticsearch {
		hosts => "localhost:9200"
		index => kv_cs6

	}
}