logs.conf

gistfile1.txt

input {
	tcp {
		port => 8000
		type => access_log
	}

}

filter {

		grok {
			match => {
				"message" => "%{IPORHOST:http_host} %{IPORHOST:client_ip} - \[%{HTTPDATE:timestamp}\] %{NUMBER:request_length} %{NUMBER:request_time} \"(?:%{WORD:http_verb} %{NOTSPACE:http_request}(?: HTTP/%{NUMBER:http_version})?|%{DATA:raw_http_request})\" %{NUMBER:status} %{NUMBER:bytes_sent} %{NUMBER:body_bytes_sent} %{QS:referer} %{QS:user_agent} %{QS:http_x_forwared_for}"
			}
		}

}

output {
	stdout {
		codec => rubydebug
	}
	elasticsearch {
		host => localhost
		cluster => charlies_cluster
	}
}