apache-elk-in-five-minutes logstash.conf

logstash.conf

input {
  tcp {
    port => 3333
  }
}

filter {
  grok {
    match => { "message" => "%{COMBINEDAPACHELOG}" }
  }
  date {
    match => [ "timestamp" , "dd/MMM/yyyy:HH:mm:ss Z" ]
  }
}

output {
  stdout {
    codec => rubydebug
  }

  elasticsearch {
    embedded => ES_EMBEDDED
    host => "ES_HOST"
    port => "ES_PORT"
    protocol => "http"
  }
}