slowlog.cfg

input {
 stdin {}
}

filter {
      grok {  
        match => [ "message", "\[%{TIMESTAMP_ISO8601:timestamp}\]\[%{DATA:loglevel}\]\[%{DATA:logtype}\] \[%{DATA:node}\] \[%{DATA:index}\]\[%{DATA:shard}\] took\[%{DATA:took}\], took_millis\[%{NUMBER:took_millis:int}\], types\[%{DATA:types}\], stats\[%{DATA:stats}\], search_type\[%{DATA:search_type}\], total_shards\[%{NUMBER:total_shards:int}\], source\[%{DATA:source_query}\], extra_source\[%{DATA:extra_source}\],"]
      }
     date {
        match => [ "timestamp", "ISO8601" ]
        remove_field => "timestamp"
     }
}

output {
 elasticsearch {
        index => "logstash-slowlog"
 }
}