filter {
  if [fields][apache_log_type] == "access_log" {
    grok {
      match => { "message" => "%{COMBINEDAPACHELOG}" }
    }
    date {
      match => [ "timestamp" , "dd/MMM/yyyy:HH:mm:ss Z" ]
    }
    mutate {
      add_field => {
        "[@metadata][target_index]" => "apache_logs-%{+YYYY.MM.dd}"
      }
    }
  } else if "swh-worker@" in [systemd_unit] {
    mutate {
      add_field => {
        "[@metadata][target_index]" => "swh_workers-%{+YYYY.MM.dd}"
      }
    }
  } else {
    mutate {
      add_field => {
        "[@metadata][target_index]" => "systemlogs-%{+YYYY.MM.dd}"
      }
    }
  }
}

filter {
  if [fields][apache_log_type] == "access_log" {
    grok {
      match => { "message" => "%{COMBINEDAPACHELOG}( %{NUMBER:duration_ms})?" }
    }
    date {
      match => [ "timestamp" , "dd/MMM/yyyy:HH:mm:ss Z" ]
    }
    mutate {
      add_field => {
        "[@metadata][target_index]" => "apache_logs-%{+YYYY.MM.dd}"
      }
      convert => {
        "response" => "integer"
        "duration_ms" => "integer"
      }
    }
  } else if "swh-worker@" in [systemd_unit] {
    mutate {
      add_field => {
        "[@metadata][target_index]" => "swh_workers-%{+YYYY.MM.dd}"
      }
    }
  } else {
    mutate {
      add_field => {
        "[@metadata][target_index]" => "systemlogs-%{+YYYY.MM.dd}"
      }
    }
  }
}

Add support an optional duration on apache logs
logstash: Add support an optional duration on apache logs

It will allow to monitor the front responses time per requests.
The conversion of the request and duration fields to integer is
mandatory to use them in some aggregation.
The ES indexes will have to be reindexed if we want to have the full
history.

Related to T2787
