grok_1529BST

    grok {
        match => [ 'message', '<%{POSINT:pri}>%{SYSLOGTIMESTAMP:timestamp} %{IPORHOST:hostname} %{WORD:app_name} %{WORD:level} %{GREEDYDATA:logmessage}' ]
        add_tag => [ "match1 greedy" ]
    }