input { http { } } filter { grok { match => {"log" => "%{COMBINEDAPACHELOG}"} match => {"message" => "(?[A-Za-z0-9_.-]+java)"} } } output { elasticsearch { hosts => ["https://localhost:9200"] user => admin password => admin index => "log-ingest" } }