Question

filter{
 grok {
    match => {
      "[log][file][path]" => "%{GREEDYDATA}/%{GREEDYDATA:app}-access.log"
    }
  }
}

filter{
  mutate {
      remove_field => [ "@timestamp" , "headers" , "response.data"]
      gsub => ["message", "\\\", ""]
    }
}