gistfile1.txt

input {
  file {
    path => "/var/log/glusterfs/*.log"
    sincedb_path => "/var/tmp/.glusterfs.sincedb"
    format => "plain"
    type => "glusterfs"
  }
  file {
    path => "/var/log/glusterfs/bricks/*.log"
    sincedb_path => "/var/tmp/.glusterfs.bricks.sincedb"
    format => "plain"
    type => "glusterfsbrick"
  }
}
filter {
  grok {
    pattern => "%{GLUSTERLOG}"
    patterns_dir => "/opt/logstash/patterns"
    type => "glusterfs"
  }
  grok {
    pattern => "%{GLUSTERLOG}"
    patterns_dir => "/opt/logstash/patterns"
    type => "glusterfsbrick"
  }
  grep {
    match => [ "timestamp", ".*" ]
    type => "glusterfs"
  }
  grep {
    match => [ "timestamp", ".*" ]
    type => "glusterfsbrick"
  }
  mutate {
    replace => [ "timestamp", "%{timestamp}+0000" ]
    type => "glusterfs"
  }
  mutate {
    replace => [ "timestamp", "%{timestamp}+0000" ]
    type => "glusterfsbrick"
  }
  date {
    timestamp => "yyyy-MM-dd HH:mm:ss.SSSSSSZ"
    type => "glusterfs"
  }
  date {
    timestamp => "yyyy-MM-dd HH:mm:ss.SSSSSSZ"
    type => "glusterfsbrick"
  }

}
output {
-- your outputs --
}

===========
/opt/logstash/patterns/glusterfs:

GLUSTERTIMESTAMP %{DATE} %{TIME}
GLUSTERCODEPART %{NOTSPACE:codefile}:%{INT:codeline}:%{NOTSPACE:codefunc}
GLUSTERLOG \[%{GLUSTERTIMESTAMP:timestamp}\] %{NOTSPACE:level} \[%{GLUSTERCODEPART}\] %{NOTSPACE:subvolume}: %{GREEDYDATA:message}