Logstash fastalert-suricata config

logstash-fast.conf

input {
  file { 
    path => "/opt/suricata/log/json-archives/*/*" 
    codec => json 
    type => "filejson"
    start_position => "beginning"
    sincedb_path => "/opt/suricata/sincedb/filejson.sincedb"
  }
  file { 
    path => "/opt/suricata/log/archives/*/*"
    exclude => "*.gz"
    type => "fastalert"
    start_position => "beginning"
    sincedb_path => "/opt/suricata/sincedb/fastalert.sincedb"
  } 
}

filter { 
  grok { 
    type => "fastalert"
    match => [ "message", "(?<timestamp>[\w].*)  \[\*\*\] \[%{NUMBER:id_1}\:%{NUMBER:id_2}\:%{NUMBER:id_3}\] %{DATA:ids_alert} \[\*\*\] \[Classification\: %{DATA:ids_classification}\]\s+\[Priority\:\s+%{NUMBER:ids_priority}\] \{%{WORD:ids_alert_proto}\}\s+%{IP:srcip}\:%{NUMBER:sp}?\s+\-\>\s+%{IP:dstip}\:%{NUMBER:dp}?$" ]
  } 
  mutate { 
    add_field => [ "copy_srcip", "%{srcip}" ]
    add_field => [ "copy_dstip", "%{dstip}" ]
  }
  date { 
    match => [ "timestamp", "MM/dd/YYYY-HH:mm:ss.SSSSSS" ] 
  } 
  if ("_grokparsefailure" in [tags]) { 
    drop {} 
  }
  if [srcip] {
    geoip {
      database => "/opt/maxmind/GeoIPCity.dat"
      source => "srcip"
      target => "geoip"
      add_field => [ "[geoip][coordinates]", "%{[geoip][longitude]}" ]
      add_field => [ "[geoip][coordinates]", "%{[geoip][latitude]}"  ]
    }
    mutate {
      convert => [ "[geoip][coordinates]", "float" ]
    }
  } 
} 

output { 
  stdout { 
	codec => rubydebug 
  } 
  elasticsearch { 
	host => "localhost" 
        cluster => "es001"
	index => "suricata-%{+YYYY.MM}"
	node_name => "Xemoe" 
        type => "suricata"
        workers => 1 
  }
  elasticsearch { 
        host => "localhost"
        cluster => "es001"
	index => "fastalert-%{+YYYY.MM}"
	node_name => "Xemoe"
	type => "fastalert"
        workers => 1 
  }
}