gistfile1.txt

input {
  file {
    type => "syslog"
    path => ["/var/log/secure", "/var/log/messages"]
    tags => ["syslog"]
  }

  pipe {
    type => "edgecast-logs"
    command => "zcat /home/edgecast/logs/*.log.gz"
    tags => ["cdn"]
  }
}

filter {
  grok {
    type => "edgecast-logs"
    pattern => "(?<timestamp>%{YEAR}-%{MONTHNUM}-%{MONTHDAY} %{TIME}) %{INT:timetaken} %{IPORHOST:clientip} %{INT:filesize} %{IPORHOST:sourceip} %{INT:sourceport} %{NOTSPACE:response} %{INT:bytes} %{WORD:verb} %{NOTSPACE:request} - %{INT:duration} %{INT:rsbytes} "(?:%{NOTSPACE:referrer}|-)" %{QUOTEDSTRING:agent} %{INT:customerid}"
  }
}