filter {
    if [type] == "nginx_access" {
        grok {
            match => [ "message" , "%{COMBINEDAPACHELOG}+%{GREEDYDATA:extra_fields}"]
            overwrite => [ "message" ]
            }
        mutate {
            convert => ["response", "integer"]
            convert => ["bytes", "integer"]
            convert => ["responsetime", "float"]
            }
        geoip {
            source => "clientip"
            target => "geoip"
            add_tag => [ "nginx-geoip" ]
            }
        date {
            match => [ "timestamp" , "dd/MMM/YYYY:HH:mm:ss Z" ]
            remove_field => [ "timestamp" ]
            }
        useragent {
            source => "agent"
            }
    }

    else if [type] == "smb-audit" {
	mutate {
	    gsub => ["message","[\\|]",":"]
	    gsub => ["message","  "," "]
	    }
        grok {
            match => [ "message" , "%{MONTH:syslog_month} %{MONTHDAY:syslog_day} %{TIME:syslog_time} %{HOSTNAME:srv_name} smbd_audit: XS:%{GREEDYDATA:user_name}:%{IP:user_ip}:%{WORD:share_name}:%{WORD:action}:%{DATA:sucess}:%{GREEDYDATA:path}"]
	    overwrite => [ "message" ]
            }
    }

    else if [type] == "smb-audit-xb" {
	mutate {
	    gsub => ["message","[\\|]",":"]
	    gsub => ["message","  "," "]
	    }
        grok {
            match => [ "message" , "%{MONTH:syslog_month} %{MONTHDAY:syslog_day} %{TIME:syslog_time} %{HOSTNAME:srv_name} smbd_audit: %{IP:user_ip}:%{WORD:share_name}:%{WORD:action}:%{DATA:sucess}:%{GREEDYDATA:path}"]
	    overwrite => [ "message" ]
            }
    }

    else if [event_data][AccessMask] == "0x10000" or [event_data][AccessMask] == "0x10080" {
	mutate {
	    add_field => { "file_action" => "delete" }
	    }
    }
    else if [event_data][AccessMask] == "0x2" or [event_data][AccessMask] == "0x6" {
	mutate {
	    add_field => { "file_action" => "write" }
	    }
    }
    else if [event_data][AccessMask] == "0x1" {
	mutate {
	    add_field => { "file_action" => "read" }
	    }
    }
    else if [host] == "10.1.4.19" or [host] == "10.1.5.1" or [host] == "10.1.4.31" {
	mutate {
	    add_tag => [ "mikrotik", "gateway" ]
	}
    }
    else if [host] == "10.1.4.66" or [host] == "10.1.3.110" or [host] == "10.1.3.111" {
        mutate {
            add_tag => [ "mikrotik", "wifi" ]
	}
    }
    else if [host] == "10.1.4.14" or [host] == "10.1.5.33" or [host] == "10.1.3.11" {
        mutate {
            add_tag => [ "mikrotik", "switch" ]
	}
    }
}