title: Logstash: replace field values matching pattern
body: <p>I'm using Elasticsearch + Logstash + kibana for windows eventlog analysis. And i get the following log:</p>
  
  <pre><code>{
    "_index": "logstash-2015.04.16",
    "_type": "logs",
    "_id": "Ov498b0cTqK8W4_IPzZKbg",
    "_score": null,
    "_source": {
      "EventTime": "2015-04-16 14:12:45",
      "EventType": "AUDIT_FAILURE",
      "EventID": "4656",
      "Message": "A handle to an object was     requested.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2832557239-2908104349-351431359-3166\r\n\tAccount Name:\t\ts.tekotin\r\n\tAccount Domain:\t\tIAS\r\n\tLogon ID:\t\t0x88991C8\r\n\r\nObject:\r\n\tObject Server:\t\tSecurity\r\n\tObject Type:\t\tFile\r\n\tObject Name:\t\tC:\\Folders\\Общая (HotSMS)\\Test_folder\\3\r\n\tHandle ID:\t\t0x0\r\n\tResource Attributes:\t-\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x4\r\n\tProcess Name:\t\t\r\n\r\nAccess Request Information:\r\n\tTransaction ID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\tAccesses:\t\tReadData (or ListDirectory)\r\n\t\t\t\tReadAttributes\r\n\t\t\t\t\r\n\tAccess Reasons:\t\tReadData (or ListDirectory):\tDenied by\tD:(D;OICI;CCDCLCSWRPWPLOCRSDRC;;;S-1-5-21-2832557239-2908104349-351431359-3166)\r\n\t\t\t\tReadAttributes:\tGranted by ACE on parent folder\tD:(A;OICI;0x1200a9;;;S-1-5-21-2832557239-2908104349-351431359-3166)\r\n\t\t\t\t\r\n\tAccess Mask:\t\t0x81\r\n\tPrivileges Used for Access Check:\t-\r\n\tRestricted SID Count:\t0",
  "ObjectServer": "Security",
  "ObjectName": "C:\\Folders\\Общая (HotSMS)\\Test_folder\\3",
  "HandleId": "0x0",
  "PrivilegeList": "-",
  "RestrictedSidCount": "0",
  "ResourceAttributes": "-",
  "@timestamp": "2015-04-16T11:12:45.802Z"
    },
    "sort": [
      1429182765802,
      1429182765802
    ]
  }
  </code></pre>
  
  <p>I get many log messages with different EventID, and when I recieve a log entry with EventID 4656 - i want to replace the value "4656" with a string "Access Failure". Is there a chance to do so?</p>