logstash.conf

input {
	tcp {
		port => 5544
		codec => json 
		ssl_cacert => "/etc/logstash/conf.d/ssl/ca.pem"
		ssl_cert => "/etc/logstash/conf.d/ssl/cert.pem"
		ssl_enable => true
		ssl_key => "/etc/logstash/conf.d/ssl/key.pem"
		ssl_verify => false
		}
 	 syslog {
   		 type => "syslog"
 	 }
}

filter {
 if [SourceModuleName] == "eventlog" {
	json{
		source => "message" 
	}

	grok { 
		add_field => { "Message_raw" => "%{Message}" }
		match => ["Message", "%{GREEDYDATA:Message}"]
		overwrite => [ "Message" ]
	}
	mutate {
		remove_field => [
			"Keywords",
			"OpcodeValue",
			"SourceModuleType",
			"Task",
			"Version",
			"message",
			"Client"
			]
		rename => [ "host", "Remote IP:Remote Port" ]
	}
  }
}


output {
  elasticsearch {
    host => "localhost"
    cluster => "<cluster name>"
    protocol => "transport"
    node_name => "logstash ES output"
  }
}