logstash-conf revision 1

input {
  beats{
    port => 5044
  }
}

filter{
    if[message] =~ "^#" { drop{} }

    if[server] == "alkistis"{
        grok{
            match => ["message", "%{TIMESTAMP_ISO8601:log_timestamp} %{IPORHOST:site} %{WORD:method} %{URIPATH:pa$
        }
    }
}

output {
  stdout { codec => rubydebug }

  elasticsearch {
    hosts => ["localhost:9200"]
    manage_template => false

    if[server] == "alkistis"{
        index => "alkistis-%{+YYYY.MM.dd}"
        document_type => "iis-log"
    }else{
        index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
        document_type => "%{[@metadata][type]}"
    }
  }
}