gistfile1.txt

input {
    generator {
        message => "9.8.7.6 5.4.3.2"
        count => 1
    }
}

filter {
   grok {
       match => [ "message", "%{IPORHOST:src} %{IPORHOST:dst}" ]
   }

    mutate {
        add_field => [ "iptmp", "%{src} %{dst}" ]
    }

    mutate {
        split => [ "iptmp", " " ]
    }

}

output {
    stdout { codec => rubydebug}
}