Logstash.conf

gistfile1.txt

input {
	stdin {
		type => "apache-access"
	}
}

filter {
	grok { match => { "message" => "%{COMBINEDAPACHELOG}" } }

	date {
		match => [ "timestamp", "dd/MMM/yyyy:HH:mm:ss Z" ]
		locale => "en"
	}

	if [clientip]  {
		geoip {
			source => "clientip"
			target => "geoip"
			add_field => ["[geoip][coordinates]","%{[geoip][longitude]}"]
			add_field => ["[geoip][coordinates]","%{[geoip][latitude]}"]
		}
		mutate {
			convert => [ "[geoip][coordinates]", "float" ]
		}
	}

	if [agent] != "-" and [agent] != "" {
		useragent {
			add_tag => [ "UA" ]
			source => "agent"
			prefix => "useragent_"
		}
	}
	if "UA" in [tags] {
		if [useragent_device] == "Other" { mutate { remove_field => "device" } }
		if [useragent_name]   == "Other" { mutate { remove_field => "name" } }
		if [useragent_os]     == "Other" { mutate { remove_field => "os" } } 
	} 
}


output {
	elasticsearch { host => localhost }
}