JBoss Logstash Configuration

jboss.conf

input {
  file {
    path => "/opt/jboss-as/standalone/log/server.log"
    start_position => end
    add_field => { "host" => "test" }
    codec => multiline {
      pattern => "^\d\d:\d\d:\d\d,\d\d\d"
      negate => true
      what => "previous"
    }
  }
  lumberjack {
    port => 5000
    ssl_certificate => "/etc/pki/tls/certs/logstash-forwarder.crt"
    ssl_key => "/etc/pki/tls/private/logstash-forwarder.key"
    codec => multiline {
      pattern => "^\d\d:\d\d:\d\d,\d\d\d"
      negate => true
      what => "previous"
    }
  }
  lumberjack {
    port => 5001
    ssl_certificate => "/etc/pki/tls/certs/logstash-forwarder.crt"
    ssl_key => "/etc/pki/tls/private/logstash-forwarder.key"
    codec => multiline {
      pattern => "^\d\d:\d\d:\d\d,\d\d\d"
      negate => true
      what => "previous"
    }
  }
lumberjack {
    port => 5003
    ssl_certificate => "/etc/pki/tls/certs/logstash-forwarder.crt"
    ssl_key => "/etc/pki/tls/private/logstash-forwarder.key"
    codec => multiline {
      pattern => "^\d\d:\d\d:\d\d,\d\d\d"
      negate => true
      what => "previous"
    }
  }
}

filter {
  grok {
    add_tag => ["default"]
    match => [ "message", "(?m)^(?<logtime>\d\d:\d\d:\d\d,\d\d\d)(\s+)%{WORD:loglevel}(\s+)\[(?<class>[^\[\]]*?)\](\s+)\((?<thread>[^\(\)]*?)\)(\s+)%{GREEDYDATA:message}" ]
    overwrite => [ "message" ]
  }
}

output {
  elasticsearch { host => localhost }
}