Regading this posting on graylog2 ML https://groups.google.com/forum/?fromgroups=#!topic/graylog2/m_8LPw9IOD4

logstash_special_conf

input {
  exec {
		command => "ifconfig eth0 | grep 'inet addr:' | cut -d: -f2 | awk '{print $1}'"
		interval => "86400"
		type => "ipv4"
	}
	file {
              	format => "plain"
                message_format => "plain"
                type => "yum_log"
                path => "/var/log/yum.log"
        }
}

filter {
	grok {
              	type => "yum_log"
                pattern => [ "<%{POSINT:syslog_pri}>%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{PROG:syslog_program}(?:\[%{POSINT:syslog_pid}\])?(:)? %{GREEDYDATA:syslog_message}" ]
        }
	syslog_pri {
      		type => "yum_log"
  	}
  	date {
      		type => "yum_log"
      		match => [ "syslog_timestamp", "MMM  d HH:mm:ss", "MMM dd HH:mm:ss" ]
  	}
  	mutate {
      		type => "yum_log"
      		exclude_tags => "_grokparsefailure"
      		replace => [ "@source_host", "%{syslog_hostname}" ]
      		replace => [ "@message", "%{syslog_message}" ]
  	}
  	mutate {
      		type => "yumlog"
      		remove => [ "syslog_hostname", "syslog_message", "syslog_timestamp" ]
  	}
	
	grok {
		type => "ipv4"
		pattern => "%{IP:hostname_ip}"
	}
}

output {
	stdout {
		debug => true
	}
       gelf {
               	type => "yum_log"
                host => "10.1.6.205"
               	port => "12201"
               	chunksize => "1420"
                sender => "%{@source_host}"
               	level => [ "INFO" ]
               	facility => "yum"
                file => "%{@source_path}"
               	full_message => "%{@message}"
        }
}