logstash-conf revision 2

    input {
    beats{
        port => 5044
    }
    }

    filter{
        if[message] =~ "^#" { drop{} }

        if[server] == "alkistis"{
            grok{
                match => ["message", "%{TIMESTAMP_ISO8601:log_timestamp} %{WORD:iisSite} %{IPORHOST:site} %{WORD:method} %{URIPATH:page} %{NOTSPACE:querystring} %{NUMBER:port} %{NOTSPACE:username} %{IPORHOST:clienthost} %{NOTSPACE:useragent} %{NOTSPACE:referer} %{NUMBER:response} %{NUMBER:subresponse} %{NUMBER:scstatus} %{NUMBER:bytes:int} %{NUMBER:timetaken:int}"]
            }
	    mutate {
		add_field => { 
			"index_type" => "alkistis"
			"doctype" => "iis-log"
		}
	    }
        }else{
	    mutate{
		add_field => { 
			"index_type" => "%{[@metadata][beat]}"
			"doctype" => "%{[@metadata][type]}"
		}
	    }
        }
    }

    output {
    stdout { codec => rubydebug }

    elasticsearch {
	user => "user"
	password => "password"

        hosts => ["localhost:9200"]
        manage_template => false

        index => "%{index_type}-%{+YYYY.MM.dd}"
        document_type => "%{doctype}"
    }
}