+ remove_field => [
+ "message",
+ "[parameters][authenticity_token]",
+ "[parameters][pass_crypt]",
+ "[parameters][pass_crypt_confirmation]",
+ "[parameters][utf8]"
+ ]
+ }
+ }
+
+ if [host] =~ /^spike-/ {
+ mutate {
+ add_tag => [ "frontend" ]
+ }
+ } else if [host] =~ /^thorn-/ {
+ mutate {
+ add_tag => [ "backend" ]