logstash_device_filtering.conf

filter {
  if [type] == "syslog" {
    dns {
      reverse => [ "host" ]
      action => "replace"
    }
  }
  if "ESXi" in [syslog_host_id] {
    mutate {
      add_tag => [ "ESXi" ]
    }
  }
  if "FW" in [syslog_host_id] {
    mutate {
      add_tag => [ "FW" ]
    }
  }
  if "NSX" in [syslog_host_id] {
    mutate {
      add_tag => [ "NSX" ]
    }
  }
}
filter {
  if "ESXi" in [tags] {
    grok {
      match => [
        "message", "blah blah ESXi message pattern(s)"
      ]
    }
  }
  if "FW" in [tags] {
    grok {
      match => [
        "message", "blah blah FW message pattern(s)"
      ]
    }
  }
  if "NSX" in [tags] {
    grok {
      match => [
        "message", "blah blah NSX message pattern(s)"
      ]
    }
  }
}