<filter wsgi_access>
  @type parser
  reserve_data true
  key_name Payload
  <parse>
    @type grok
    grok_pattern %{IPORHOST:clientip} %{HTTPDUSER:ident} %{USER:auth} \[%{HTTPDATE:Timestamp}\] "(?:%{WORD:http_method} %{NOTSPACE:http_url}(?: HTTP/%{NUMBER:http_version})?|%{DATA:rawrequest})" %{NUMBER:http_status} (?:%{NUMBER:http_bytes}|-) (?:%{NUMBER:http_response_time_us}|-) %{QS:referrer} %{QS:agent}
    time_key Timestamp
    time_format %d/%b/%Y:%H:%M:%S %z
    keep_time_key true
  </parse>
</filter>
