sample logstash configuration file

logstash.conf

input {



tcp {

	port => 5140

	type => "windows-events"

	codec => json {

		charset => "CP1252"

    	}

}



tcp {

        port => 5141

        type => "ossec-events"

        codec => json {

                charset => "CP1252"

        }

}

syslog {
    type => "syslog"

}


}



filter {

 

  mutate {

    add_field => { "Sender_IP" => "%{host}" }

  }





  if [type] == "windows-events" {





	if [Message] =~ "My first log .*"{

		  grok {

		    match => [ "Message", 'My first log %{GREEDYDATA:custom_message}' ]

		    add_tag => ["grokked"]

		  }

	}



	  date {

	      match => ["[EventTime]", "YYYY-MM-dd HH:mm:ss"]

	  }

  }



   if [type] == "ossec-events" {



          grok {

            add_tag => ["AlienVault"]

          }



  }

 



}



output {



stdout { }

  elasticsearch {

	host => "localhost"

	template => "/callHome/logstash-1.4.2/lib/logstash/outputs/elasticsearch/elasticsearch-template.json"

	template_overwrite => true

  }



}