Как фильтровать трафик в logstash?

Есть такие логи:

{
  "_index": "filebeat-6.8.15-2021.04.08",
  "_type": "_doc",
  "_id": "9AKesXgB3KIPxKt1f5zA",
  "_score": 1,
  "_source": {
    "requset_id": "[3b358c6e5fa35f13a71c5ab194754199]",
    "timestamp": "2021-04-08T16:12:34.389334",
    "@timestamp": "2021-04-08T13:12:35.082Z",
    "https://qna.habr.com/q/tags": [
      "sed2.rtech.ru",
      "beats_input_codec_plain_applied"
    ],
    "input": {
      "type": "log"
    },
    "beat": {
      "name": "sed2.rtech.ru",
      "hostname": "sed2.rtech.ru",
      "version": "6.8.15"
    },
    "@version": "1",
    "message": "INFO, [2021-04-08T16:12:34.389334 #22938]  --  [3b358c6e5fa35f13a71c5ab194754199] [ES Query] GET http://cluster.elastic.sed2.rtech.ru:9200/incoming_documents_production_db_core_cards_incoming_documents_cards_2021,incoming_documents_production_db_core_cards_incoming_documents_cards_no_year/_search?from=0&size=10 [status:200, request:0.883s, query:0.003s]",
    "host": {
      "containerized": false,
      "name": "sed2.rtech.ru",
      "architecture": "x86_64",
      "os": {
        "name": "Ubuntu",
        "family": "debian",
        "codename": "trusty",
        "platform": "ubuntu",
        "version": "14.04.6 LTS, Trusty Tahr"
      },
      "id": "fbe96c6e791e31d5a2f7e323580db99c"
    },
    "pid": "#22938",
    "prospector": {
      "type": "log"
    },
    "source": "/home/esd-admin/apps/cards/current/incoming_documents/log/production.log",
    "log": {
      "file": {
        "path": "/home/esd-admin/apps/cards/current/incoming_documents/log/production.log"
      }
    },
    "msg": " [ES Query] GET http://cluster.elastic.sed2.rtech.ru:9200/incoming_documents_production_db_core_cards_incoming_documents_cards_2021,incoming_documents_production_db_core_cards_incoming_documents_cards_no_year/_search?from=0&size=10 [status:200, request:0.883s, query:0.003s]",
    "level": "INFO",
    "offset": 920843638
  },
  "fields": {
    "@timestamp": [
      "2021-04-08T13:12:35.082Z"
    ],
    "timestamp": [
      "2021-04-08T16:12:34.389Z"
    ]
  }
}

Распарсить логи, с условием, откуда приходит файл,если путь откуда пришёл лог совпадает, с путём, который я ввёл, то лог парсился, вот паттерн:

filter {
   if "/home/esd-admin/apps/background_jobs/current/log/production.log" in [source] or "/home/esd-admin/apps/cards/current/incoming_orders/log/production.log" in [source] {
   grok {
     match => { "message" => "(?<level>^w+)W+(?<timestamp>sd+-d+-w+:w+:w+.w+|[(d+d+-d+-w+:w+:w+.w+)).(?<pid>#d+).+(?<requset_id>[w+]).+(?<tag>[w+sw+]).(?<method>[A-Z]+s)(?<url>httpS+)s[status:(?<status>d+),srequest:(?<request>(d+.w+)),squery:(?<query>.+)]"}
    }
  } else{
   grok {
     match => { "message" => "(?<level>^w+)W+(?<timestamp>d+-d+-w+:w+:w+.w+|[(d+d+-d+-w+:w+:w+.w+)).(?<pid>#d+)D+(?<requset_id>[w+])(?<msg>.+)"}
    }
}
}

Сейчас логи не парсятся