Logstash: Cisco Firepower

filter {
    if {{ CISCO_FIREPOWER }} {
        kv {
            id => "cisco-firepower-kv"
            field_split_pattern => ", "
            value_split => ":"
            trim_value => "\""
            tag_on_timeout => "timeout"
            target => "{{ TARGET }}"
        }
    }
}