logstash config

logstash.config

input {
  tcp {
    port => 5514
  }
  udp {
    port => 5514
  }
}

filter {
  grok {
    match => { "message" => "%{COMBINEDAPACHELOG}" }
  }
}

output {

  if [type] == "syslog" and "_grokparsefailure" in [tags] {
      file { path => "/var/log/failed_syslog_events-%{+YYYY-MM-dd}" }
  }
  elasticsearch {
    embedded => true
  }
}