logstash.conf

gistfile1.txt

input {
  file {
    type => "syslog"
    path => [ # "/ext/var/log/*.log",
              "/ext/var/log/messages",
              "/ext/var/log/syslog"
            ]
    start_position => "beginning"
  }
}

filter {
  grok {
    match => [ "message", "%{SYSLOGBASE}" ]
  }
  date {
    match => ["timestamp", "MMM  d HH:mm:ss", "MMM dd HH:mm:ss"]
  }
}
 
output {
  stdout { 
    codec => rubydebug
  }
  elasticsearch {
    embedded => true
    index => "log"
    index_type => "message"
  }
}