gistfile1.txt

input {
        file {
                path => "/var/log/httpd/logstash-acc.log"
                codec => json
                type => "tracking"
                discover_interval => 1
          }
}

#filter {
#        grok {
#               match => [ "message", "%{TIMESTAMP_ISO8601:timestamp} %{IP:client_ip} %{NUMBER:client_port:int} %{NUMBER:latency_ms:float} %{NUMBER:latency_sec:float} %{NUMBER:elb_status_code:int} %{QS:request} %{QS:referer} %{QS:user_agent}" ]
#       }
#}

filter {
        geoip {
                add_tag => [ "geoip" ]
                source => "client_ip"
                database => "/gluster/videomobile/tracking/logstash-resources/GeoIP.dat"
        }
}
filter {
  kv {
    source => "request"
    field_split => "&?"
  }
}


output {

        file {
                path => "/media/ephemeral0/logstash_logs/bq.log"
                codec => "plain"
                message_format => "%{bq_timestamp},%{client_ip},%{elb_status_code},%{referer},%{e},%{w},%{vid},%{vname},%{ecpm},%{adid},%{media_file_type},%{media_file_url},%{current_url},%{apid},%{d},%{device},%{csize},%{token}"

        }
        elasticsearch {
                host => "video.hostname.com"
                flush_size => 2200
                workers => 2
        }
}