logstash config

gistfile1.txt

input {

  syslog {
    type => "syslog"
    port => "514"
    format => "plain"
  }

  file {
    type => "syslog"
    path => ['/var/log/syslog']
    exclude => "*.gz"
  }

}

filter {
  if [type] == "syslog" {
    grok {
      type => "syslog"
      add_tag => ["syslog"]
      match => ["message", "%{SYSLOGLINE}"]
    }
  }
}

output {
  stdout {
   debug => true
   debug_format => "json"
  }
  elasticsearch  {
    node_name => "logstash-prod-1"
    host => "x.x.x.x"
    cluster => "appops_logging"