Logstash gzipped files recursively - elasticbeanstalk logs

logstash-recursive-gzip.conf

input {
  pipe {
    command => "find ./path -type f -name *.gz -exec gunzip --to-stdout '{}' + "
  }
}

filter {
  grok {
    patterns_dir => ["./patterns"]
    match => [
      "message", "%{TIMESTAMP_ISO8601:timestamp} - %{WORD:loglevel}: %{PLAINTEXT:text}",
      "message", "%{COMBINEDAPACHELOG}"
    ]
  }
  date {
    match => ["timestamp", "ISO8601", "dd/MMM/YYYY:HH:mm:ss Z"]
  }
}

output {
  elasticsearch { hosts => ["localhost:9201"] }
}

patterns-text

# contents of ./patterns/text:
PLAINTEXT [^$]+