logstash rule

input {
	tcp {
		port => 5000
	}
}

## Add your filters / logstash plugins configuration here
filter {
  kv {
      source => "message"
      field_split => "[,\s]"
      value_split => ":"
    }
  ruby {
    code => "
      hash = event.to_hash
      hash.each { |key,value|
          event.set(key.gsub('kv.', '').gsub('\"', ''), value)
      }
   "
   }
}

output {
	elasticsearch {
		hosts => "elasticsearch:9200"
		user => "elastic"
		password => "changeme"
	}
}