logstash config example using custom grok filters

logstash_slowservice.conf

input {
  file {
    type => "WASSystemOut"
    start_position => "beginning"
    # path => ["/var/log/secure", "/var/log/messages"]
    # exclude => ["*.gz"]
    path => ["/waslogs/SystemOut*log"]
  }
}

filter {
  if [type] == "WASSystemOut" {
    if [message] !~ /SLOW SERVICE DETECTED/ {
      drop {}
    }

    grok {
      match => [ "message", "\[%{DATESTAMP:datetime} %{WORD}\] %{GREEDYDATA}SLOW SERVICE DETECTED: time: %{INT:duration:int} ms class (?<slowservicename>(?:[A-z0-9-]+\.)+[A-z0-9$]+)" ]
      add_tag => [ "slow-service", "grokked" ]
    }

    date {
      match => [ "datetime", "M/d/yy HH:mm:ss:SSS" ]
      timezone => [ "CET" ]
      add_tag => [ "dated" ]
    }
  }
}

output {
  # stdout { codec => rubydebug }
  file {
    message_format => "%{@timestamp};%{slowservicename};%{duration}"
    path => "/tmp/logstash.out" 
  }
  
  elasticsearch {  }
}