SQUID grok filter and output Open Disto for Elasticsearch

conf.d_squid

input {
  beats {
    type => "squid"
    port => 5044
    ssl => true
    ssl_certificate_authorities => ["/etc/metricbeat/MyRootCA.pem"]
    ssl_certificate => "/etc/metricbeat/odfe-node1.pem"
    ssl_key => "/etc/metricbeat/odfe-node1.key"

  }
}

filter {
    grok {
        match => ["message","%{INT:timestamp}.%{INT}\s*%{NUMBER:request_msec:float} %{IPORHOST:src_ip} %{WORD:cache_result}/%{NUMBER:response_status:int} %{NUMBER:response_size:int} %{WORD:http_method} (%{URIPROTO:http_proto}://)?%{IPORHOST:dst_host}(?::%{POSINT:port})?(?:%{DATA:uri_param})? %{USERNAME:cache_user} %{WORD:request_route}/(%{IPORHOST:forwarded_to}|-) %{GREEDYDATA:content_type}"]  
        add_tag => ["squid"]
        }    
    date {
        match => [ "timestamp", "UNIX" ]
        }
}

output {
   if [source] == "/var/log/squid/access.log" and [type] == "squid" {
     elasticsearch {
         hosts => ["https://192.168.1.20:9200"]
         index => "squid-tikitikiv3"
         cacert => "/etc/metricbeat/MyRootCA.pem"
         user => admin
         password => admin
         ssl => true
         ssl_certificate_verification => false
     }
  }
}