logstash.conf for ngx_http_accounting_module

logstash-accounting.conf

input {
    stdin {}
}
filter {
    grok {
        match => [ "message", "^%{SYSLOGTIMESTAMP:timestamp}\|\| pid:\d+\|from:\d{10}\|to:\d{10}\|accounting_id:%{WORD:accounting}\|requests:%{NUMBER:req:int}\|bytes_out:%{NUMBER:size:int}\|%{DATA:status}"]
    }
    kv {
        target => "code"
        source => "status"
        field_split => "|"
        value_split => ":"
    }
    ruby {
        code => "n={};event['code'].each_pair{|x,y|n[x]=y.to_i};event['code']=n"
    }
}
output {
    stdout { codec => rubydebug }
}