input { file { type => "log" #stat_interval => "\t" path => "/home/hadoop/xinwang_XW351464_2110.log" } } filter { if [path] =~ "xinwang_XW351464_2110" { mutate { replace => { "type" => "apache_access" } } grok { match => { "mes