logstash.conf

input {
  file {
    type => nginx_web
    path => ["/var/log/nginx/*"]
    exclude => ["*.gz"]
  }
}

filter {
  grok {
    type => "nginx_web"
    pattern => "%{COMBINEDAPACHELOG}"
  }
}

output {
  elasticsearch { embedded => true }
}

logstash.sh

#! /bin/sh

### BEGIN INIT INFO
# Provides:          logstash-shipper
# Required-Start:    $remote_fs $syslog
# Required-Stop:     $remote_fs $syslog
# Default-Start:     2 3 4 5
# Default-Stop:      0 1 6
# Short-Description: Start daemon at boot time
# Description:       Enable service provided by daemon.
### END INIT INFO

. /lib/lsb/init-functions

name="logstash"
logstash_bin="/usr/bin/java -- -jar /etc/logstash/logstash.jar"
logstash_conf="/etc/logstash/logstash.conf"
logstash_log="/var/log/logstash/logstash.log"
pid_file="/var/run/$name.pid"

start () {
	command="${logstash_bin} agent -f $logstash_conf --log ${logstash_log}"

	log_daemon_msg "Starting $name"
	if start-stop-daemon --start --quiet --oknodo --pidfile "$pid_file" -b -m --exec $command; then
		log_end_msg 0
	else
		log_end_msg 1
	fi
}

stop () {
	start-stop-daemon --stop --quiet --oknodo --pidfile "$pid_file"
}

status () {
	status_of_proc -p $pid_file "" "$name"
}

case $1 in
	start)
		if status; then exit 0; fi
		start
		;;
	stop)
		stop
		;;
	reload)
		stop
		start
		;;
	restart)
		stop
		start
		;;
	status)
		status && exit 0 || exit $?
		;;
	*)
		echo "Usage: $0 {start|stop|restart|reload|status}"
		exit 1
		;;
esac

exit 0