filter {

if [type] == "mod_security" {

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

# Parse out fields from Section C (post data)

# this is not always present

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

if [rawSectionC] =~ /.+/ {

mutate {

add_field => { "requestBody" => "%{rawSectionC}" }

}

}

}

}