filter-10-header.conf

filter {
  grok {
    match => ["message","\[%{YEAR:year}-%{MONTHNUM:monthnum}-%{MONTHDAY:monthday} %{HOUR:hour}:%{MINUTE:minute}:%{SECOND:second} %{ISO8601_TIMEZONE:timezone}\] %{WORD:[icinga][severity]}/%{WORD:[icinga][facility]}: %{GREEDYDATA:message}"]
    add_tag => ["icinga2_header"]
    tag_on_failure => ["_grokparsefailure","icinga2_header_failed"]
    id => "icinga2"
    overwrite => "message"
  }
  mutate {
    add_field => {
      "[icinga][timestamp]" => "%{[year]}-%{[monthnum]}-%{[monthday]} %{[hour]}:%{[minute]}:%{[second]} %{[timezone]}"
    }
  }
  date {
    match => ["[icinga][timestamp]", "yyyy-MM-dd HH:mm:ss Z"]
  }
  mutate {
    remove_field => ["[icinga][timestamp]","year","monthnum","monthday","hour","minute","second","timezone"]
  }
}