gistfile1.txt

input {
  tcp {
    port => 5000
    format => json_event
    type => raw
}

filter {
  grep {
      tags => web
      drop => false
      add_field => [ "application", "web" ]
  }

  mutate {
      tags => web
      replace => [ "@message", "%{request}" ]
  }
}

output {
...
}