Nagios simple log parsing

logstash.conf

input {
  zeromq {
    type     => 'zmq'
    topology => 'pushpull'
    address  => 'tcp://*:5556'
    mode     => 'server'
  }
}

output {
  elasticsearch {
    cluster => "ELA003"
    index   => "nagios-logstash-%{+YYYY.MM.dd}"
    tags    => ["nagios"]
  }

  stdout {
    debug => true
    debug_format => "json"
    tags => ["nagios"]
  }
}

filter {
grok {
  tags      => ["nagios"]
  match   => [ "@message",  "\[%{NUMBER:timestamp}\]\s%{DATA:type}\:\s%{DATA:host}\;%{DATA:check}\;%{DATA:level}\;%{DATA:alert}\;%{DATA:repeat}\;%{GREEDYDATA:comment}" ]
}

mutate {
  remove => ["timestamp"]
}

}