anchor.diff:      start_position => beginning
     }
   
  -  file {
  -    path => "/opt/log/*/messages"
  -    type => "syslog"
  -    start_position => beginning
  -  }
  -
  -
   }
   
   filter {
  
positive.code:         "message", "%{TIMESTAMP_ISO8601:timestamp} %{LOGLEVEL:loglevel} %{HOSTNAME:hostname} %{DATA:component} %{GREEDYDATA:message}"
        ]
        add_tag => "openstack_logs"
      }
    } else if [type] == "syslog" {
      if [message] =~ /(?i)nova|glance|neutron|cinder|keystone|horzion|calico|etcd/ {
          drop{}
      }
      grok {
        break_on_match => true
        match => [
          "message", "%{TIMESTAMP_ISO8601:timestamp} %{WORD:syslog_type}.%{WORD:loglevel} %{HOSTNAME:hostname} %{GREEDYDATA:message}"
        ]
        add_tag => "system_logs"
      }
    }
  }
  
negative.code:       ]
        add_tag => "rabbitmq_logs"
      }
    } else {
      grok {
        break_on_match => true
        match => [
  