gistfile1.rb

input {
  syslog {
    type => "syslog"
    port => 514
    tags => ["rdns"]
  }
}

filter {
  dns {
    action => ["replace"]
    tags => ["rdns"]
    reverse => "@source_host"
  }
  gelfify { }
}

output {
  gelf {
    host => "localhost"
  }
  file {
    gzip => true
    path => "/logarchive/%{+YYYY}/%{+MM}/%{+dd}/%{@source_host}.log.gz"
  }
}