dynamic.conf

input {
    generator {
        message => "user=jhenderson name=Justin computer=IT02"
        count => 1
    }
}
filter {
    kv {
        source => "message"
    }
    # Once I hit this point there is a field called user
    if [user] == "jhenderson" or [user] == "sarah" {
        mutate {
            add_field => {
                "[group][it]" => "Domain Admin"
            }
            add_field => {
                "[@metadata][test]" => "This is a test value"
            }
        }
        # This example changes a nested field back to a top level field
        mutate {
            rename => {
                "[group][it]" => "group"
            }
        }
    }
}
output {
    stdout {
        codec => rubydebug {
            metadata => true # metadata by default is not visible
        }
    }
    udp {
        host => "${SYSLOGSERVER}"
        port => 514
    }
    file {
        path => "/tmp/%{user}.%{+yyyy.MM.dd}.log"
    }
}