Logstash configuration

logstash.conf

# This is a configuration for Logstash acting like that:
#
## INPUT
#  - Syslog server listening on (custom >1024 as we don't run it as root) UDP/10514
#  - GELF event listening on (default) UDP/12201
#
## FILTERING
#  - Nothing here yet
#
## OUTPUT
#  - 
#

input {
  udp {
    port => 10514
    type => "syslog-udp-10514"
  }
}

filter {
grok {
      type => "syslog-udp-10514"
      pattern => [ "<%%{POSINT:syslog_pri}>%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{PROG:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" ]
      add_field => [ "received_at", "%{@timestamp}" ]
      add_field => [ "received_from", "%{@source_host}" ]
  }
  syslog_pri {
      type => "syslog-udp-10514"
  }
  date {
      type => "syslog-udp-10514"
      syslog_timestamp => [ "MMM  d HH:mm:ss", "MMM dd HH:mm:ss" ]
  }
  mutate {
      type => "syslog-udp-10514"
      exclude_tags => "_grokparsefailure"
      replace => [ "@source_host", "%{syslog_hostname}" ]
      replace => [ "@message", "%{syslog_message}" ]
  }
  mutate {
      type => "syslog-udp-10514"
      remove => [ "syslog_hostname", "syslog_message", "syslog_timestamp" ]
  }
}

output {
  stdout { }
}