title: Logstash - grok use a field other than message
body: <p>I am receiving Log4j generated log files from remote servers using Logstash forwarder. The log event has fields including a field named "file" in the format /tomcat/logs/app.log, /tomcat/logs/app.log.1, etc. Of course file path /tomcat/logs is on the remote machine and I would like Logstash to create files on the local file system using only the file name and not use the remote file path.</p>
  
  <p>Locally, I would like to create a file based on file name app.log, app.log.1, etc. How can one accomplish this?</p>
  
  <p>I am unable to use grok since it appears to work only with "message" field and not others. </p>
  
  <p>Example Log Event:</p>
  
  <p>{"message":["11 Sep 2014 16:29:04,934 INFO LOG MESSAGE DETAILS HERE "],"@version":"1","@timestamp":"2014-09-15T05:44:43.472Z","file":["/tomcat/logs/app.log.1"],"host":"aus-002157","offset":"3116","type":"app.log"}</p>
  
  <p>Logstash configuration  - what do I use to write the filter section? </p>
  
  <pre><code>input {
      lumberjack {
        port =&gt; 48080
        ssl_certificate =&gt; "/tools/LogStash/logstash-1.4.2/ssl/logstash.crt"
        ssl_key =&gt; "/tools/LogStash/logstash-1.4.2/ssl/logstash.key"
      }
  }
  
  filter{
  
  }
  
  output {
  
      file{
          #message_format =&gt; "%{message}"
          flush_interval =&gt; 0
          path =&gt; "/tmp/%{host}.%{type}.%{filename}"
          max_size =&gt; "4M"
      }
  }
  </code></pre>