Logstash tcp syslog日志分字段

Logstash如何给通过TCP input采集的syslog日志分字段， 为什么我grok什么的都没有用呢？
日志Json格式如下：
{
  "_index": "it_mail_gateway_201806",
  "_type": "type",
  "_id": "it_mail_gateway_0_4076560_0",
  "_score": null,
  "_source": {
    "@timestamp": "2018-06-26T02:57:16.939Z",
    "port": 42119,
    "sinkTime": 1529981837979,
    "@version": "1",
    "host": "172.20.1.34",
    "message": "<23> outbound/smtp: 127.0.0.1 1529981836-0e410871de2a8c0001-E7LUoT 0 0 SEND - 1 BA4C7128008D 250 2.6.0 <b4ba97dccda04c7eb759c16ccd116785@BJEXCAS002.didichuxing.com> [InternalId=47102906341693, Hostname=BJSGEXMBX07.didichuxing.com] Queued mail for delivery #to#172.20.1.40[172.20.1.40]:25",
    "type": "syslog"
  },
  "fields": {
    "sinkTime": [
      1529981837979
    ],
    "@timestamp": [
      1529981836939
    ]
  },
  "sort": [
    1529981837979
  ]
}