mktik sample log

{
  "_index": "mikrotik-log-2020.11",
  "_type": "_doc",
  "_id": "f9yFgnUBAnhF-USAF3ck",
  "_version": 1,
  "_score": null,
  "_source": {
    "topic1": "system",
    "topic2": "error",
    "agent": {
      "hostname": "XXXXXXXX",
      "name": "XXXXXXXXXXX",
      "id": "00d3c06f-ecf6-442c-99bf-d7e79f879413",
      "type": "filebeat",
      "ephemeral_id": "45272364-bdcd-493d-bfae-2dc1dba7ff1b",
      "version": "7.9.3"
    },
    "method": "winbox",
    "log": {
      "source": {
        "address": "XXXXX"
      }
    },
    "topic3": "critical",
    "message": "system,error,critical login failure for user admin from XXXXXXXXXXX via winbox",
    "input": {
      "type": "syslog"
    },
    "@timestamp": "2020-11-01T06:36:00.698Z",
    "ecs": {
      "version": "1.5.0"
    },
    "host": {
      "hostname": "XXXXXXXXXX",
      "os": {
        "kernel": "3.10.0-1127.19.1.el7.x86_64",
        "codename": "Core",
        "name": "CentOS Linux",
        "family": "redhat",
        "version": "7 (Core)",
        "platform": "centos"
      },
      "ip": [
        "XXXXXXXXXXXX"
      ],
      "containerized": false,
      "name": "Main_Mikrotik",
      "id": "e8399b31db114cb6986556de9a0750c1",
      "mac": [
        "XXXXXXXXXXX"
      ],
      "architecture": "x86_64"
    },
    "action": "login failure",
    "user": "admin",
    "host_adress": "192.168.1.XXX"
  },
  "fields": {
    "@timestamp": [
      "2020-11-01T06:36:00.698Z"
    ]
  },
  "sort": [
    1604212560698
  ]
}