This Logstash Configuration takes Syslog Messages, add some additional Fields and Information to them and send them via GELF to graylog2-radio which put them into rabbitmq transport Inspiration from: http://cookbook.logstash.net/recipes/syslog-pri/ (but little modified to match my needs) http://blog.torch.sh/post/43651465177/introducing-graylog2…

logstash_syslog_to_gelf

input {
  tcp {
    port => 514
    type => syslog
  }
  udp {
    port => 514
    type => syslog
  }
}

filter {
  grok {
      type => "syslog"
      pattern => [ "<%{POSINT:syslog_pri}>(%{SYSLOGTIMESTAMP:syslog_timestamp}|%{TIMESTAMP_ISO8601:syslog_timestamp}) %{SYSLOGHOST:syslog_hostname} %{PROG:syslog_program}(?:\[%{POSINT:syslog_pid}\])?(:)? %{GREEDYDATA:syslog_message}" ]
      add_field => [ "received_at", "%{@timestamp}" ]
      add_field => [ "received_from", "%{@source_host}" ]
  }
  syslog_pri {
      type => "syslog"
  }
  date {
      type => "syslog"
      match => [ "syslog_timestamp", "MMM  d HH:mm:ss", "MMM dd HH:mm:ss" ]
  }
  mutate {
      type => "syslog"
      exclude_tags => "_grokparsefailure"
      replace => [ "@source_host", "%{syslog_hostname}" ]
      replace => [ "@message", "%{syslog_message}" ]
  }
  mutate {
      type => "syslog"
      remove => [ "syslog_hostname", "syslog_message", "syslog_timestamp" ]
  }
}


output {
  # Emit events to stdout for easy debugging of what is going through
  # logstash.
  # stdout { }

 gelf {
   chunksize => 1420
   facility => "%{syslog_facility}"
   host => "localhost"
   level => "%{syslog_severity}"
   # we queue them via amqp
   port => 12502
   sender => "%{@source_host}"
 }

}