Logstash conf to parse apache log and remove additional geoip and agent fields.

apache_2.conf

input {
  stdin { }
}

filter {
  grok {
    match => {
      "message" => '%{IPORHOST:clientip} %{USER:ident} %{USER:auth} \[%{HTTPDATE:timestamp}\] "%{WORD:verb} %{DATA:request} HTTP/%{NUMBER:httpversion}" %{NUMBER:response:int} (?:-|%{NUMBER:bytes:int}) %{QS:referrer} %{QS:agent}'
    }
  }

  date {
    match => [ "timestamp", "dd/MMM/YYYY:HH:mm:ss Z" ]
    locale => en
  }

  geoip {
    source => "clientip"
  }

  useragent {
    source => "agent"
    target => "useragent"
  }

  mutate {
    remove_field => ["timestamp", "ident", "httpversion","[useragent][os_major]","[useragent][os_minor]","[useragent][major]","[useragent][minor]","[geoip][region_code]","[geoip][region_name]","[geoip][latitude]","[geoip][longitude]","[geoip][dma_code]","[geoip][continent_code]","[geoip][country_code3]"]
  }

}

output {
  elasticsearch {
    hosts => ["localhost:9200"]
    index => "apache_access_5"
    template => "apache_sizing_1.json"
    template_name => "elk_workshop"
    template_overwrite => true
  }
}