apache pruning

logstash.excerpt

  if [type] == "apache_json" {
    geoip { source => "clientip" }
    if [useragent] != ""  { useragent { source => "useragent" } }
    if [auth]      == "-" { mutate { remove_field => "auth" } }
    if [ident]     == "-" { mutate { remove_field => "ident" } }
    if [referer]   == "-" { mutate { remove_field => "referer" } }
  }