[LOGSTASH] Grok pattern for AWS Cloudfront logs

cloudfront_filter

filter {
    if [cloudfront_version] {
      mutate {
         gsub => ["message", "\t", " "]
                  }
        dissect {
            mapping => {"message" => "%{date} %{time} %{x_edge_location} %{sc_bytes} %{clientip} %{cs_method} %{cs_host} %{cs_uri_stem} %{sc_status} %{referrer} %{agent} %{cs_uri_query} %{cookies} %{x_edge_result_type} %{x_edge_request_id} %{x_host_header} %{cs_protocol} %{cs_bytes} %{time_taken} %{x_forwarded_for} %{ssl_protocol} %{ssl_cipher} %{x_edge_response_result_type} %{cs_protocol_version}"}
            convert_datatype => {
                sc_bytes => "int"
                sc_status => "int"
                cs_bytes => "int"
                time_taken => "float"
            }
            add_field => {"timestamp" => "%{date} %{time}"}
        }
        date {
            match => ["timestamp", "yyyy-MM-dd HH:mm:ss", "yyyy-MM-dd   HH:mm:ss"]
            timezone => "UTC"
        }
        geoip {
            source => "clientip"
        }
        mutate {
            replace => {
                "type" => "cloudfront"
            }
            remove_field => ["timestamp","message","cloudfront_fields"]
        }
    }
}