anchor.diff:        ]
       }
     }
  +
     if [type] == 'nginx_json' {
       json {
         source => 'message'
  
positive.code:       source => 'client_ip'
      }
    }
  }
  
negative.code:       rename => [ 'logsource', 'host' ]
      }
    }
  
    if [type] == 'rails' {
      grok {
        match => [
  