filter {
      if [type] == "proxy_bluecoat" {
            # drop comment lines
        if ([message] =~ /^#/) {
          drop{}
        }
        csv {
            columns => ["date", "time", "time_taken", "c_ip", "sc_status", "s_action", "sc_bytes", "cs_bytes", "cs_method", "cs_uri_scheme", "cs_host", "cs_uri_port", "cs_uri_path", "cs_uri_query", "cs_username", "s_supplier_name", "rs_content_type", "cs_referer", "cs_user_agent", "sc_filter_result", "cs_categories", "s_ip", "r_dns", "r_ip", "x_cs_dns"]
            separator => " "
        }
               if [timestamp] {
          date {
            match => ["timestamp", "YYYY-MM-dd HH:mm:ss" ]
          }
        } else if [gmttime] {
          date {
            match => ["gmttime", "dd/MM/YYYY:HH:mm:ss' GMT'"]
            timezone => ['UTC']
          }
        } else if [localtime] {
          date { match => ["localtime", "[dd/MMM/YYYY:HH:mm:ss Z]"] }
        } else if [date] and [time] {
          mutate { merge => ["date", "time"] }
          mutate { join => ["date", " "] }
          date {
            match => ["date", "YYYY-MM-dd HH:mm:ss" ]
            timezone => ['UTC']
          }
        }
        if ([s_supplier_ip] and [s_supplier_ip] != "-") {
          geoip {
            source => "s_supplier_ip"
          }
        }
        mutate {
          convert => ["sc_bytes", "integer",
                      "time_taken", "integer",
                      "r_port", "integer",
                      "s_port", "integer",
                      "cs_bytes", "integer",
                      "duration", "integer"
                      ]
        }

        if [cs_user_agent] != "" {
          useragent { source => "cs_user_agent" prefix => "user_agent." }
        }

       mutate {
          remove_field => ["message", "host", "date", "time", "timestamp", "gmttime", "localtime"]
        }
      }
    }