Bro-Conn-Logs-Logstash-Config

input {
  beats {
    host => "localhost"
    port => 5044
  }
}

filter {
  if [message] =~ /^#/ {
    drop { }
  }

  if [type] == "bro-conn" {
    
    csv {
      columns => ["ts","uid","id.orig_h","id.orig_p","id.resp_h","id.resp_p","proto","service","duration","orig_bytes","resp_bytes","conn_state","local_orig","local_resp","missed_bytes","history","orig_pkts","orig_ip_bytes","resp_pkts","resp_ip_bytes","tunnel_parents"]
      separator => "	"
    }

    date {
      match => [ "ts", "UNIX" ]
    }

    geoip {
       source => "id.orig_h"
    }

    mutate {
      convert => { "id.orig_p" => "integer" }
      convert => { "id.resp_p" => "integer" }
      convert => { "orig_bytes" => "integer" }
      convert => { "duration" => "float" }
      convert => { "resp_bytes" => "integer" }
      convert => { "missed_bytes" => "integer" }
      convert => { "orig_pkts" => "integer" }
      convert => { "orig_ip_bytes" => "integer" }
      convert => { "resp_pkts" => "integer" }
      convert => { "resp_ip_bytes" => "integer" }
      rename =>  { "id.orig_h" => "id_orig_host" }
      rename =>  { "id.orig_p" => "id_orig_port" }
      rename =>  { "id.resp_h" => "id_resp_host" }
      rename =>  { "id.resp_p" => "id_resp_port" }
    }
  }

}

output { 
  elasticsearch {
    hosts => ["localhost:9200"]
  }
}

Hi there,
Thank you for your sharing this configuration.
And I just want to ask how can I filter some fields from all *.log file then save it to a table?