logstash glastopf parser

filter {
    if [type] == "glastopf" {
        grok {
            match => [ "message", "%{TIMESTAMP_ISO8601:logdate} \(%{NOTSPACE:internal_src}\) %{DATA:message}$" ]
            overwrite => [ "message" ]
        }
        date {
            match => [ "logdate", "YYYY-MM-dd HH:mm:ss,SSS" ]
            timezone => "Europe/Berlin"
        }

        if [internal_src] == "glastopf.glastopf" {
            grok {
                match => [ "message", "%{IP:src_ip} requested %{WORD:http_method} %{NOTSPACE:requested_url} on %{HOST:hostname}:%{POSINT:port}" ]
            }
        } else {
            mutate {
                drop { }
            }
        }
    }

    if [src_ip] {
        geoip {
            source => src_ip
        }

        geoip {
            source => src_ip
            database => "/opt/logstash/vendor/geoip/GeoIPASNum.dat"
        }
    }
}