Logstash parsing dpkg.log

gistfile1.txt

            else if [fields][log_format] == "dpkg" {
                grok {
                    match => { "message" => "%{TIMESTAMP_ISO8601:timestamp} %{GREEDYDATA:message}" }
                    overwrite => [ "message" ]
                }
                date {
                    match  => [ "timestamp", "YYYY-MM-dd HH:mm:ss" ]
                    remove_field => [ "timestamp" ]
                }
                grok {
                    match => {
                        "message" => [
                            "^startup " ,
                            "^(?<_action>install|upgrade|configure|remove|purge) (?<_package>[^ :]+)(:(?<_architecture>\S+))? (?<_version>\S+) (?<_oldversion>\S+)",
                            "^status (?<_status>\S+) (?<_package>[^ :]+)(:(?<_architecture>\S+))? (?<_version>\S+)",
                            "^trigproc (?<_package>[^ :]+)(:(?<_architecture>\S+))? (?<_version>\S+)"
                        ]
                    }
                }
                if [_package] {
                    mutate {
                        add_field => { "[package][name]" => "%{_package}" }
                        remove_field => [ "_package" ]
                    }
                }
                if [_architecture] {
                    mutate {
                        add_field => { "[package][architecture]" => "%{_architecture}" }
                        remove_field => [ "_architecture" ]
                    }
                }
                if [_version] {
                    mutate {
                        add_field => { "[package][version]" => "%{_version}" }
                        remove_field => [ "_version" ]
                    }
                }
                if [_oldversion] {
                    mutate {
                         add_field => { "[package][oldversion]" => "%{_oldversion}" }
                         remove_field => [ "_oldversion" ]
                    }
                }
                if [_action] {
                    mutate {
                        add_field => { "[package][action]" => "%{_action}" }
                        remove_field => [ "_action" ]
                    }
                }
                if [_status] {
                    mutate {
                        add_field => { "[package][status]" => "%{_status}" }
                        remove_field => [ "_status" ]
                    }
                }
            }

Does this work for you? My tests look good so far...