apache_file.conf

input {
  file {
    start_position => "beginning"
    path => "/path/to/*.log"
    type => "apache"
    sincedb_path => "/dev/null" # causes to re-read everytime
  }
}
 
filter {
  grok {
    type => "apache"
    pattern => ["%{COMBINEDAPACHELOG}"]
  }
 
  date {
    type => "apache"
    #18/Aug/2011:05:44:34 -0700
    match => [ "timestamp", "dd/MMM/yyyy:HH:mm:ss Z" ]
  }
}
 
output {
  elasticsearch {
    embedded => true
  }
}

Thanks again for the assist - I updated the blog, gave credit. Really was finagling with that for a bit, but as soon as I saw this gist, it all made sense. Coming up for air has its benefits sometimes.

Quick note, "type" and "pattern" are on the chopping block for grok..the 'if' tests and 'match' details appear to have replaced them.