Logstash - HTTP parcer for Suricata IDS

input {
    file {
        path => [ "/tmp/http.log" ]
        sincedb_path => "/dev/null"
        start_position => "beginning"
    }
}
filter {
    grok {
        match => {
            "message" => "%{GREEDYDATA:timestamp} %{HOSTNAME:http.host} ?\[?\*?\*?\] %{GREEDYDATA:http.path}  ?\[?\*?\*?\] %{GREEDYDATA:http.useragent}  ?\[?\*?\*?\] %{IP:http.source.ip}:%{NUMBER:http.source.port} %{GREEDYDATA} %{IP:http.dest.ip}:%{NUMBER:http.dest.port}"
        }
    }
    if "_grokparsefailure" in [tags] {
        drop { }
    }
    date {
        match => ["timestamp", "MM/dd/yyyy-HH:mm:ss.SSSSSS"]
        timezone => "America/Toronto"
        target => ["@timestamp"]
    }
}
output {
        elasticsearch {
                hosts => ['адрес этого гребанного эластика:9200']
        }
}