debug

{
         "@source" => "stdin://ctclnxmgr01/",
           "@tags" => [],
         "@fields" => {
           "clientip" => [
            [0] "76.19.107.28"
        ],
              "ident" => [
            [0] "-"
        ],
               "auth" => [
            [0] "-"
        ],
          "timestamp" => [
            [0] "25/May/2013:16:16:16 +0000"
        ],
               "verb" => [
            [0] "GET"
        ],
            "request" => [
            [0] "/origin.hosted.domain/dynamic/proxy-partial-js/ibd.morningstar.com/AP/MarketIndexGraph.html?CN=AP707&gf=3&idx=2&SITE=MABOH&SECTION=DJSP_COMPLETE"
        ],
        "httpversion" => [
            [0] "1.1"
        ],
           "response" => [
            [0] "200"
        ],
              "bytes" => [
            [0] "2141"
        ],
           "referrer" => [
            [0] "\"http://bostonherald.com/\""
        ],
              "agent" => [
            [0] "\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:2.0.1) Gecko/20100101 Firefox/4.0.1\""
        ],
            "urihost" => [
            [0] "origin.hosted.domain"
        ],
                "uri" => [
            [0] "/dynamic/proxy-partial-js/ibd.morningstar.com/AP/MarketIndexGraph.html"
        ],
        "querystring" => [
            [0] "?CN=AP707 gf=3 idx=2 SITE=MABOH SECTION=DJSP_COMPLETE"
        ],
                "?CN" => "AP707",
                 "gf" => "3",
                "idx" => "2",
               "SITE" => "MABOH",
            "SECTION" => "DJSP_COMPLETE",
                  "q" => nil
    },
      "@timestamp" => "2013-05-25T16:16:16.000Z",
    "@source_host" => "ctclnxmgr01",
    "@source_path" => "/",
        "@message" => "76.19.107.28 - - [25/May/2013:16:16:16 +0000] \"GET /origin.hosted.domain/dynamic/proxy-partial-js/ibd.morningstar.com/AP/MarketIndexGraph.html?CN=AP707&gf=3&idx=2&SITE=MABOH&SECTION=DJSP_COMPLETE HTTP/1.1\" 200 2141 \"http://bostonherald.com/\" \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:2.0.1) Gecko/20100101 Firefox/4.0.1\" \"SITE=MABOH; SECTION=DJSP_COMPLETE\"",
           "@type" => "hosted"
}

filter

  grok {
    type    => "hosted"
    pattern => "%{COMBINEDAPACHELOG}"
  }


  date {
    type  => "hosted"
    match => [ "timestamp", "dd/MMM/yyy:HH:mm:ss Z" ]
  }

  # Properly parse the request uri as a url
  grok {
    type  => "hosted"
    match => [
      "request", "/%{URIHOST:urihost}%{URIPATH:uri}%{URIPARAM:querystring}?"
    ]
  }

  # Remove unneeded fields and fix up the querystring a bit
  mutate {
    type   => "hosted"
#    remove => [ "agent", "auth", "bytes", "httpversion", "ident", "referrer", "timestamp", "verb" ]
    gsub => [
      "querystring", "&", " "
    ]
  }

  # Parse out the querystring as a key => value hash so that we can analyze this later
  kv {
    type   => "hosted"
    source => ["querystring"]
    trim   => "\"\?;"
  }
  urldecode {
    field => "q"
  }