#arrakis logstash.conf

logstash.conf

input {
  file {
    path => "/home/drew/.znc/users/drewzar/moddata/log/*arrakis*.log"
    start_position => "beginning"
  }
  stdin { }
}

filter{ 
  grok {
    match => [ "path", "/home/drew/.znc/users/drewzar/moddata/log/\#arrakis_%{YEAR:ds}%{MONTHNUM:ds}%{MONTHDAY:ds}.log"]
    match => [ "path", "/home/drew/.znc/users/drewzar/moddata/log/default_\#arrakis_%{YEAR:ds}%{MONTHNUM:ds}%{MONTHDAY:ds}.log"]
  }
  mutate {
    join => [ "ds", "-" ]
  }
  grok {
    match => [ "message", "\[%{TIME:ds}\] <%{DATA:nick}> %{GREEDYDATA:message}" ]
    overwrite => [ "message" ]
  }
  mutate {
    join => [ "ds" , "T" ]
  }
  date {
    match => [ "ds", "ISO8601" ]
  }
}

output{ 
  elasticsearch {
    host => localhost
  }
  stdout { }
}