Sending filebeats to logstash

filebeat.yml

# this goes on the server with the logs 
filebeat:
  prospectors:
    -
      paths:
        - "/var/log/nginx/*"
      document_type: nginx-logs
  registry_file: "/var/log/beat.log"
output:
  logstash:
    # replace with appropriate values for your setup:
    hosts: ["logstash.service.consul:5044"]

logstash_nginx_with_beats.conf

input {
	stdin { }

	beats {
    	port => 5044
    }
}

filter {
	# type is set by document_type in filebeats
	if [type] == "nginx-logs" {
		grok {
	        match => { "message" => "%{NGINXACCESS}" }
	    }
		geoip {
		    source => "clientip"
		}
	}
}

## Add your filters here
output {
	elasticsearch {
		hosts => "elasticsearch:9200"
		index => "%{index}-%{type}-%{+YYYY.MM.dd}"
	}
	stdout { codec => rubydebug }
}

nginx_patterns

# put it at: /opt/logstash/patterns/nginx
NGUSERNAME [a-zA-Z\.\@\-\+_%]+
NGUSER %{NGUSERNAME}
NGINXACCESS %{IPORHOST:clientip} %{NGUSER:ident} %{NGUSER:auth} \[%{HTTPDATE:timestamp}\] "%{WORD:verb} %{URIPATHPARAM:request} HTTP/%{NUMBER:httpversion}" %{NUMBER:response} (?:%{NUMBER:bytes}|-) (?:"(?:%{URI:referrer}|-)"|%{QS:referrer}) %{QS:agent}