logstash.conf

input {
	tcp {
		port => 5000
	}
}

filter {
  grok {
    match => {
      "message" => "%{SYSLOG5424PRI:pri}%{NUMBER:rfc_version} %{TIMESTAMP_ISO8601:timestamp} d.%{UUID:drain_id} %{WORD:app} %{USERNAME:dyno} - - %{GREEDYDATA:message}"
    }
    overwrite => ["message"]
    remove_field => ["pri", "rfc_version", "dyno", "timestamp", "syslog5424_pri"]
  }

  if [drain_id] == "380ffb06-081d-431b-8ccd-c2571e70c49b" {
      mutate {
        add_field => { "data_source" => "noticen_staging" }
      }
  }

  if [message] =~"^\{.*\}[\s\S]*$" {
    json {
      source => "message"
    }
    mutate {
      add_tag => ["json"]
    }
  }
}
output {
	elasticsearch {
		hosts => "elasticsearch:9200"
		user => "elastic"
		password => "changeme"
	}
}