logstash.conf

input {
    file {
        path => "/var/log/messages"
        type => "syslog"
    }
    file {
        path => "/var/log/php_errors.log"
        type => "phperror"
    }
    file {
        path => "/var/log/httpd/access_log"
        type => "apache_access"
    }
    file {
        path => "/var/log/httpd/error_log"
        type => "apache_error"
    }
}

filter {
  if [type] == "apache_access" {
      grok { 
        match => ["message", "%{COMBINEDAPACHELOG}"]
      }
  } else if [type]== "syslog" {
      grok {
        match => ["message", "%{SYSLOGBASE2} %{GREEDYDATA:message}" ]
        overwrite => ["message"]
      }
  } else if [type] == "phperror" {
      grok { 
        patterns_dir => "./p"
        match => ["message", "%{PHP_LOG}"]
        overwrite => ["message"]
      }
  } 
}

output { 
  #stdout { codec => rubydebug }
  elasticsearch { embedded => true }
  if [type] == "apache_access" {
    statsd {
      host => "localhost"
      port => 8125
      namespace => "logstash"
      increment => "apache.httpcode.%{response}"
    }
  } else if [type] == "phperror" {
    statsd {
      host => "localhost"
      port => 8125
      namespace => "logstash"
      increment => "phperror.level.%{level}"
    }
  }
}