Logstash Config to parse SpotInstance Datafeed

spotpricing.conf

# Create a custom pattern in the patterns_dir: INSTANCEID \i-\w{8,17}

input {
  s3 {
    bucket => "com.example.bucketname"
    region => "eu-west-1"
    access_key_id => "A*******************"
    secret_access_key => "*********************************"
    type => "spotpricing"
    codec => line
  }
}

# Replace EU-SpotUsage with your region prefix if necessary!

filter {
  if [type] == "spotpricing" {
    grok {
      patterns_dir => ["/etc/logstash/patterns"]
      match => {"message" => "\A%{TIMESTAMP_ISO8601:timestamp}\s%{NOTSPACE}\s*EU-SpotUsage:(?<instancetype>\S+)\s*%{NOTSPACE}\s*%{INSTANCEID:instanceid}\s*%{NOTSPACE}\s*%{BASE10NUM} %{NOTSPACE}\s*%{BASE10NUM:price}"}
    }
    date {
        match => ["timestamp", "yyyy-MM-dd HH:mm:ss"]
        remove_field => ["timestamp"]
    }
    mutate {
        convert => ["price", "float"]
    }
    mutate {
      remove_field => ["message", "cloudfront_fields", "cloudfront_version", "host"]
    }
  }
}