
filter {
    csv {
        columns => [
          "datetime",
          "url",
          "doc_id",
          "section_type",
          "type",
          "data_type",
          "yop",
          "mime",
          "action_type",
          "access_policy",
          "embargo_end",
          "delivered_content",
          "access_type",
          "access_method",
          "title",
          "doi",
          "content_length",
          "site_name",
          "ctitle",
          "publisher",
          "publisher_id",
          "ctitle_doi",
          "ctitle_proprietary_id",
          "isbn",
          "print_issn",
          "online_issn",
          "ctitle_uri",
          "container_proprietary_id",
          "container_title",
          "container_uri",
          "container_doi",
          "platform_name",
          "platform_id",
          "institution_id",
          "institution_name",
          "consortium",
          "log_id",
          "client_ip",
          "session_id",
          "geoip-country",
          "geoip-latitude",
          "geoip-longitude",
          "user_id",
          "status",
          "referer",
          "user-agent",
          "client_name",
          "client_domain",
          "client_org_type",
          "client_city",
          "client_country",
          "client_localisation",
          "client_cidr_from",
          "client_cidr",
          "oa_id",
          "oa_type",
          "oa_open_access",
          "oa_domains",
          "oa_fields",
          "oa_subfields",
          "oa_apc_list",
          "oa_apc_paid",
          "oa_cited_by_count",
          "oa_cited_by_api_url",
          "oa_fwci",
          "oa_funders",
          "oa_sustainable_development_goals"
        ]
        separator => ";"
        remove_field => ["message"]
        }
    date {
        match => ["time", "ISO8601"]
    }
    mutate {
        convert => ["TempOut", "float"]
        split  => ["action_type", ","]
        split  => ["consortium", ","]
        split  => ["institution_id", ","]
        split => ["oa_domains", "|"]
        split => ["oa_fields", "|"]
        split => ["oa_subfields", "|"]
        split => ["oa_funders", "|"]
        split => ["oa_sustainable_development_goals", "|"]
        remove_field => ["[event][original]"]
    }
}
