title: How can Filebeat specify match rules to Logstash
body: <p>I want to let Logstash'gork filter use the match rules which Filebeat give</p>
  
  <p>Here is my Filebeat config:</p>
  
  <pre><code>filebeat.inputs:
  - type: log
    enabled: true
    paths:
      - /root/Log-test/test.log
    fields:
      "@metadata":
          formatter: "%{TIMESTAMP_ISO8601:timestamp} - %{NOTSPACE:module} - %{LOGLEVEL:level} - %{NOTSPACE:filename} - %{GREEDYDATA:log_message}"
    fields_under_root: true
  
  output.logstash:
    hosts: ["localhost:5045"]
  </code></pre>
  
  <p>Here is my Logstash config:</p>
  
  <pre><code>input {
      beats {
          port =&gt; "5045"
      }
  }
  
  filter {
    grok {
      match =&gt; { "message" =&gt; "%{[@metadata][formatter]}" }
    }
  }
  
  output {
    file {
      path =&gt; "/tmp/log-test.log"
      codec =&gt; rubydebug { metadata =&gt; true }
    }
  }
  </code></pre>
  
  <p>So, i want the grok know my match rules content (the <code>message</code> field) is <code>"%{TIMESTAMP_ISO8601:timestamp} - %{NOTSPACE:module} - %{LOGLEVEL:level} - %{NOTSPACE:filename} - %{GREEDYDATA:log_message}"</code></p>
  
  <p>But the setting above do not work, I want to know how can i implement the funciton like this? or is it possible to make it?</p>
  
  <p>Thanks!</p>