new logstash

input {
  gelf {
    type => "lb12202"
    port => 12202
  }
  gelf {
    type => "lb12203"
    port => 12203
  }
  gelf {
    type => "lb12204"
    port => 12204
  }
}

filter {
    if [facility] =~ /^p(gatew|tr)ay$/ {
       mutate {
          rename => [ "@timestamp", "client_timestamp" ]
       }
       ruby {
          code => "event['@timestamp'] = LogStash::Timestamp.new"
       }
    }
}

output {
  elasticsearch {
    hosts    => ["es.endpoint:80"]
    workers => 32
  }
  if [type] == "lb12202"
  {statsd {
    host => "statsd.foo.bar"
    port => 8125
    sender => "aws-cffbccc2"
    increment => "message.gelf"
  }}
  if [type] == "lb12203"
  {statsd {
    host => "statsd.foo.bar"
    port => 8125
    sender => "aws-cffbccc2"
    increment => "message.gelf"
  }}
  if [type] == "lb12204"
  {statsd {
    host => "statsd.foo.bar"
    port => 8125
    sender => "aws-cffbccc2"
    increment => "message.gelf"
  }}
}