Logstash config file on Ubuntu.

logstash.conf

input {
 file {
  path => "/var/log/tomcat8/localhost_access_log*"
  start_position => beginning
  sincedb_path => "/dev/null"
  ignore_older => 0
  type => "access_log"
 }
}

filter {
 grok {
  patterns_dir => "./patterns"
  match => { "message" => "%{COMMONAPACHELOG}" }
  add_tag  => [ "combined_apache_log", "extended_tomcat_log" ]
 }
 date {
  timezone => "Asia/Taipei"
  match => [ "timestamp", "dd/MMM/yyyy:HH:mm:ss Z" ]
  add_tag => [ "timestamped" ]
 }
 geoip {
  source   => "clientip"
  database => "/geo/lite/city/database/path/GeoLiteCity.dat"
  target   => "geoip"
#  fields   => [ "city_name", "country_code2", "country_name", "location", "real_region_name", "postal_code" ]
  add_field => [ "[geoip][coordinates]", "%{[geoip][longitude]}" ]
  add_field => [ "[geoip][coordinates]", "%{[geoip][latitude]}"  ]
  add_tag  => [ "geoip" ]
 }
 mutate {
  convert => [ "[geoip][coordinates]", "float"]
 }
}

output {
 elasticsearch {
  hosts => ["elasticsearch_name:9200"]
  index => "dsahboard-raw"
  document_type => "cartridge"
 }
  stdout {
    codec => rubydebug
  }
}