Logstash - pihole dns parcer

################# INPUT #################

input {
    file {
        path => [ "/tmp/pihole/pihole.*" ]
        sincedb_path => "/dev/null"
        start_position => "beginning"
    }
}

################# FILTER #################

filter {

    if "query" in [message] {
        grok {
            match => {
                "message" => "%{MONTH:month}  %{MONTHDAY:day} %{TIME:time} %{SYSLOGPROG} ?\[%{WORD:pid}?]: %{WORD:pihole.dns.message.type}?\[%{WORD:pihole.dns.record.type}?] %{GREEDYDATA:pihole.dns.request} %{WORD} %{IP:pihole.dns.client.ip}"
            }
        }
        if "_grokparsefailure" in [tags] {
            drop { }
        }
    }

    else if "forwarded" in [message] {
        grok {
            match => {
                "message" => "%{MONTH:month}  %{MONTHDAY:day} %{TIME:time} %{SYSLOGPROG} ?\[%{WORD:pid}?]: %{WORD:pihole.dns.message.type} %{GREEDYDATA:pihole.dns.request} %{WORD} %{IP:pihole.dns.server.ip}"
            }
        }
        if "_grokparsefailure" in [tags] {
            drop { }
        }
    }

    else if "reply" in [message] and "<CNAME>" in [message] {
        grok {
            match => {
                "message" => "%{MONTH:month}  %{MONTHDAY:day} %{TIME:time} %{SYSLOGPROG} ?\[%{WORD:pid}?]: %{WORD:pihole.dns.message.type} %{GREEDYDATA:pihole.dns.request} %{WORD} ?\<%{WORD:pihole.dns.record.type}?\>"
            }
        }
        if "_grokparsefailure" in [tags] {
            drop { }
        }
    }

    else if "reply" in [message] and "<CNAME>" not in [message]{
        grok {
            match => {
                "message" => "%{MONTH:month}  %{MONTHDAY:day} %{TIME:time} %{SYSLOGPROG} ?\[%{WORD:pid}?]: %{WORD:pihole.dns.message.type} %{GREEDYDATA:pihole.dns.request} %{WORD} %{IP:pihole.dns.reply.ip}"
            }
        }
        geoip {
            source => "pihole.dns.reply.ip"
        }
        if "_grokparsefailure" in [tags] {
            drop { }
        }
    }

    else if "cached" in [message] and "<CNAME>" in [message] {
        grok {
            match => {
                "message" => "%{MONTH:month}  %{MONTHDAY:day} %{TIME:time} %{SYSLOGPROG} ?\[%{WORD:pid}?]: %{WORD:pihole.dns.message.type} %{GREEDYDATA:pihole.dns.request} %{WORD} ?\<%{WORD:pihole.dns.record.type}?\>"
            }
        }
        if "_grokparsefailure" in [tags] {
            drop { }
        }
    }

    else if "cached" in [message] and "NXDOMAIN" not in [message] {

        grok {
            match => {
                "message" => "%{MONTH:month}  %{MONTHDAY:day} %{TIME:time} %{SYSLOGPROG} ?\[%{WORD:pid}?]: %{WORD:pihole.dns.message.type} %{GREEDYDATA:pihole.dns.request} %{WORD} %{IP:pihole.dns.reply.ip}"
            }
        }

        if "_grokparsefailure" in [tags] {
            grok {
                match => {
                    "message" => "%{MONTH:month}  %{MONTHDAY:day} %{TIME:time} %{SYSLOGPROG} ?\[%{WORD:pid}?]: %{WORD:pihole.dns.message.type} %{IP:pihole.dns.reply.ip} %{WORD} %{GREEDYDATA:pihole.dns.request}"
                }
            }
        }

        else "_grokparsefailure" in [tags] {
            drop { }
        }
    }

    else {
        drop { }
    }
}

################# OUTPUT #################

output {
    elasticsearch {
        hosts => ['192.168.15.77:9200']
    }
}