Пример td-agent.conf для демонстрации

td-agent.conf

<source>
  @type tail
  format /(?<schema>https?)://(?<domain>[^ ]*) (?<remote>[^ ]*) (?<host>[^ ]*) (?<user>[^ ]*) \[(?<time>[^\]]*)\] "(?<method>\S+)(?: +(?<path>[^\"]*?)(?: +\S*)?)?" (?<code>[^ ]*) (?<size>[^ ]*)(?: "(?<referer>[^\"]*)" "(?<agent>[^\"]*)") (?<message>.*) (?<resptime>\d+\.\d+)$/
  time_format %d/%b/%Y:%H:%M:%S %z
  types remote:string,host:string,user:string,time:time,method:string,path:string,code:integer,referer:string,agent:string,message:string,size:integer,resptime:float
  path /tmp/access.log
  pos_file /tmp/access_tail_pos.log
  tag es.demo.access
  read_lines_limit 1000
</source>

<filter es.**>
  @type record_transformer
  enable_ruby
  auto_typecast true
  <record>
    hostname ${hostname}
    bitps ${record["size"] * 8 / (record["resptime"] + 0.001)}
  </record>
</filter>

<match *.**>
    @type elasticsearch_dynamic
    buffer_type memory
    buffer_chunk_limit 100m
    buffer_queue_limit 128
    logstash_format true
    logstash_prefix   ${tag_parts[1]}
    include_tag_key true
    tag_key @log_name
    host 127.0.0.1
    port 9200
    time_key_format %Y-%m-%dT%H:%M:%S.%N%z
    flush_interval 10s
</match>