logstash.example.conf

input {
  tcp {
    port => 5044
    ecs_compatibility => "v1"
    codec => json_lines {
      ecs_compatibility => "v1"
    }
  }
}

filter {
  grok {
    ecs_compatibility => "v1"
    match => { "message" => "(?<[@metadata][index]>security-(input-request|output-request|command|celery-task-run|celery-task-invocation)-log) %{NOTSPACE:[@metadata][version]} %{NOTSPACE:[@metadata][id]} %{GREEDYDATA:request_data}" }
  }
}
filter {
  json{
    ecs_compatibility => "v1"
    source => "request_data"
    remove_field => "request_data"
  }
  mutate {
    remove_field => ["@version", "@timestamp", "message", "event", "log_name", "original", "hostname", "tags", "level", "logger_name", "type", "stack_info"]
  }
}
filter {
  mutate {
    rename => { "meta" => "[extra_data][meta]" }
  }
}

output {
  elasticsearch {
    ecs_compatibility => "v1"
    hosts => "elasticsearch:9200"
    index => "%{[@metadata][index]}-%{+YYYY-MM-dd}"
    document_id => "%{[@metadata][id]}"
    version => "%{[@metadata][version]}"
    version_type => "external"
  }
}