Grok, grep, multiline, date, etc. Logstash changes my events prior to reaching their destination, but logstash itself is not the end destination.