gistfile1.txt

input {
  stdin {
  }
}
  

filter{

	grok {
	    #10.251.55.76 (193.137.28.200) 10.251.55.76 (193.137.28.200,193.137.28.201,193.137.28.202,193.137.28.203)
	    match => ["message","%{IPORHOST:clientip} \(%{GREEDYDATA:iplist}\)"]
	}
        
        csv {
            source => ["iplist"]
            columns => ["ip_"]
        }
}

output {
  stdout { codec => json }
}