# First config
input {
	tcp {
		port => 5044
		type => json
	}
}
filter {
	json {
		source => "message"
	}
}

output {
    stdout { codec => rubydebug }
}

# Line I'm trying to parse
{
"logger_name" => "scrapy.core.scraper",
"host" => "192.168.0.88",
"stack_info" => nil,
"type" => "logstash",
"@timestamp" => 2019-08-14T15:38:40.011Z,
"spider" => "<SiteSpider 'site-scraper' at 0x7f474bedc908>",
"port" => 56576,
"tags" => ,
"@version" => "1",
"level" => "DEBUG",
"message" => "Scraped from <200 https://example.com/new_posts>\n{'link': 'https://example.com//3g67o/post/hjg78g78t',\n 'image': 'https://cdnthumb2.example.com/liuh89/ios.jpg'}",
"path" => "/home/drake/virtualenv/newscrapy/lib/python3.6/site-packages/scrapy/core/scraper.py"
}

#second filter
filter {
	json {
		source => "message"
	}
	if "DEBUG" in [level] {
		grok {
			patterns_dir => ["/vagrant/patterns"]
			match => { "message" => "<%{CODE} %{URL}>\n%{JITEM}" }
		}
	}
}

# My patterns_dir file
CODE [0-9]{3}
URL http[s]?://.*
JITEM {.*}