Some time a go I've came across the dissect filter for logstash to extract data from my access_logs before I hand it over to elasticsearch. Dissect is a different type of filter than grok since it does not use regex, but it's an alternative way to aproach data. Dissect