[kordless]

Right! Speaking of that, have you looked at Grok (field extractor)? It's pretty awesome.

[adient]

Grok, grep, multiline, date, etc. Logstash changes my events prior to reaching their destination, but logstash itself is not the end destination.