mongodb log logstash grok filter

logstash.conf

filter {
    if [type] == "mongo-log" {
        grok {
            match => {"message" => "%{TIMESTAMP_ISO8601:timestamp}\s+%{MONGO3_SEVERITY:severity}\s+%{MONGO3_COMPONENT:component}\s+(?:\[%{DATA:context}\])?\s+%{GREEDYDATA:message}"}
            overwrite => [ "message" ]
            remove_tag => ["beats_input_codec_plain_applied"]
        }

        if [context] =~ "^conn" {
            grok {
               match => {"context" => "conn%{NUMBER:connect_id:int}"}
            }
        }

        if [message] =~ "ms$"  {
             grok {
               match => {"message" => "%{WORD:op_type}\s+.*}.*\}(\s+%{NUMBER:spend_time:int}ms$)?"}
            }
        }

       if [message] =~ "^end\s+connection" {
            grok {
               match => {"message" => "end\s+connection\s+%{IPORHOST:client_ip}:%{NUMBER:client_port:int}.*"}
               add_tag => ["end_connection"]
            }
        }

        if [message] =~ "^connection\s+accepted\s+from" {                                                                                                                                                                                                                                 grok {
               match => {"message" => "connection\s+accepted\s+from\s+%{IPORHOST:client_ip}:%{NUMBER:client_port:int}\s+#%{NUMBER:connect_id:int}.*"}                                                                                                                                        add_tag => ["start_connection"]
            }                                                                                                                                                                                                                                                                         }
                                                                                                                                                                                                                                                                                      date {
            match => [ "timestamp", "UNIX", "YYYY-MM-dd HH:mm:ss", "ISO8601"]
            remove_field => [ "timestamp" ]
        }
    }
}

Hello Xu, you used which pattern for that, I can't see any?

Hi,

This is not working

For me is working.. good job