working_logstash_syslog.rb

# This file was created for i-55aef515
# by Chef
# Manual changes will be lost
input {

    file {
        'path' => ['/var/log/syslog', '/var/log/messages']
        'start_position' => 'beginning'
        'type' => 'syslog'
    }
}

filter {

    if [type] == "syslog" {
        grok {
            overwrite => "message"
            match => {
                message => "^(?:<%{POSINT:syslog_pri}>)?%{SYSLOGTIMESTAMP:timestamp} %{SYSLOGHOST:syslog_hostname} (?:%{PROG:program}(?:\[%{POSINT:pid}\])?: )?%{GREEDYDATA:message}"
                add_field => [ "received_at", "%{@timestamp}" ]
                add_field => [ "received_from", "%{@host}" ]
            }
        }
        syslog_pri { }
        date {
            # season to taste for your own syslog format(s)
            match => [ "timestamp",  "MMM  d HH:mm:ss", "MMM dd HH:mm:ss", "ISO8601" ]
        }

        if !("_grokparsefailure" in [tags]) {
            mutate {
                replace => [ "@source_host", "%{host}" ]
                replace => [ "@message", "%{message}" ]
            }
            mutate {
                remove_field => [ "syslog_hostname", "syslog_message", "syslog_timestamp", "timestamp" ]
            }
        }
    }
}

output {
    tcp { host => "0.0.0.0" port => "5959" }
}