logstash conf

app.conf

input { 
    stdin { type => example } 
    file {
        #any line not starting with a tleast 10 dashes belongs with the previous line
        codec => multiline {
            pattern => "^-{10,}"
            negate => true
            what => next
        }
        path => "C:/applogs/*.log"
        type => "app"
   }
}

filter{
	if [type] == "app" {
           ruby {
             code => " 
                rows = event['message'].split(/\r\n/)
                            .partition{|x| x=~/\AError Description:\s|Exception Message:\s|\s{1,4}at\s/} 
                event['ExceptionMessage'] = rows[0].join($/).sub(/Error Description: |Exception Message: /,'')
                remove = []
                rows[1].each do |i|
                    i.scan(/(.+): (.*)/) do |x,y|
                        event[x.delete(' ')] = y
                        remove.push(i)
                    end
                end
                msg = rows[1].reject{|x| x.start_with? *remove, '------'}.join($/)
                event['message'] = msg
                call = msg.match /Service (call|function) (?<name>\w+)/i
                event['ServiceCall'] = call['name'] unless call.nil?
            "
        }   
        date {
            match => [ "DateTime", "dd/MM/yyyy HH:mm:ss.SSSSSSS" ]
            #timezone => "Etc/UCT"
        }
    } 
}
output { 
if [type] == "app"{
  stdout { codec => rubydebug }
  }
  elasticsearch { embedded => true }
}

iis.conf

input { 
    stdin { type => example } 
    file {
        codec => plain
        path => "C:/iislogs/*.log"
        type => "iis"
   }
}
 
filter{
	if [type] == "iis" {
        if [message] =~ "^#" {
            drop {}
        }			
        grok {
            match => ["message", "%{TIMESTAMP_ISO8601:log_timestamp} %{WORD:iisSite} %{HOST:site} %{IP:ip} %{WORD:method} %{URIPATH:url} %{NOTSPACE:querystring} %{NUMBER:port} %{NOTSPACE:username} %{IP:clientip} %{NOTSPACE:httpversion} %{NOTSPACE:useragent} %{NOTSPACE:cookie} %{NOTSPACE:referer} %{HOST:clienthost} %{NUMBER:statuscode} %{NUMBER:substatuscode} %{NUMBER:win32status} %{NUMBER:scbytes} %{NUMBER:csbytes} %{NUMBER:timetaken}"]
        }    
        date {
            match => [ "log_timestamp", "YYYY-MM-dd HH:mm:ss" ]
            timezone => "Etc/UCT"
            }	
        useragent {
            source=> "useragent"
            prefix=> "browser"
        }
		mutate {
            remove_field => [ "log_timestamp"]
        }
    } 
}
 
output { 
  stdout { codec => rubydebug }
  elasticsearch { embedded => true }
}

rmq.conf

input { 
    rabbitmq {
        durable => true
        exchange => "logstash"
        codec => json
        host => "localhost"
        passive => false
        password => "guest"
        port => 5672
        prefetch_count => 1
        ssl => false
        # tags => ... # array (optional)
        type => "nlog"
        user => "guest"
        verify_ssl => false
        vhost => "/"
   }
}
 
filter{
    if [type] == "nlog" {
        date{
            match => ["TimeStampUtc", "ISO8601"]
        }   
    }
}
 
output { 
  stdout { codec => rubydebug }
  elasticsearch { embedded => true }
}