filter-50-remotecheckqueue.conf

filter {
  if [icinga][facility] == "RemoteCheckQueue" {
    grok {
      match => ["message","items: %{NUMBER:[icinga][itemscount]}, rate: %{NUMBER:[icinga][itemsrate]}/s \(%{NUMBER:[icinga][items01min]}/min %{NUMBER:[icinga][items05min]}/5min %{NUMBER:[icinga][items15min]}/15min\);"]
      id => "icinga_remotecheckqueue"
      add_tag => "icinga_remotecheckqueue"
      tag_on_failure => ["_grokparsefailure","icinga_remotecheckqueue_failed"]
      add_field => {
        "[icinga][eventtype]" => "remote_check_queue"
      }
    }
  }
}