[LOGSTASH] Grok pattern for AWS ELB Application Logs

alb_filter

filter {
  if [type] == "elb-l7" {
    grok {
      match => [ "message", "%{TIMESTAMP_ISO8601:timestamp} %{NOTSPACE:elb} %{IP:clientip}:%{INT:clientport:int} (?:(%{IP:backendip}:?:%{INT:backendport:int})|-) %{NUMBER:request_processing_time:float} %{NUMBER:backend_processing_time:float} %{NUMBER:response_processing_time:float} (?:-|%{INT:elb_status_code:int}) (?:-|%{INT:backend_status_code:int}) %{INT:received_bytes:int} %{INT:sent_bytes:int} \"%{ELB_REQUEST_LINE}\" \"(?:-|%{DATA:user_agent})\" (?:-|%{NOTSPACE:ssl_cipher}) (?:-|%{NOTSPACE:ssl_protocol})" ]
    }
    date {
      match => [ "timestamp", "ISO8601" ]
    }
    mutate {
      remove_field => [ "message", "timestamp" ]
    }
    geoip {
            source => "clientip"
        }
    mutate {
        update => {
            "type" => "elb-l7-log"
        }
    }
  }
}

This works pretty well. Thanks

I've removed the part where original message field was removed (just personal thing)