anchor.diff:        ]
         add_tag => "rabbitmq_logs"
       }
  -  } else if [type] =~ /^(nova|glance|neutron|cinder|keystone|horzion)$/ {
  +  } else {
       grok {
         break_on_match => true
         match => [
  
positive.code:         "message", "%{TIMESTAMP_ISO8601:timestamp} %{LOGLEVEL:loglevel} %{HOSTNAME:hostname} %{DATA:component} %{GREEDYDATA:message}"
        ]
        add_tag => "openstack_logs"
      }
    } else if [type] == "syslog" {
      if [message] =~ /(?i)nova|glance|neutron|cinder|keystone|horzion|calico|etcd/ {
          drop{}
      }
      grok {
        break_on_match => true
        match => [
          "message", "%{TIMESTAMP_ISO8601:timestamp} %{WORD:syslog_type}.%{WORD:loglevel} %{HOSTNAME:hostname} %{GREEDYDATA:message}"
        ]
        add_tag => "system_logs"
      }
    }
  }
  
negative.code:     start_position => beginning
    }
  
  }
  
  filter {
  