gistfile1.txt

input {

     redis {
       host => "redis_server"
       data_type => "list"
       key => "cloudtrail"
       type => "json"
       }
}

filter {

    if ("splitted" in [tags]) {
      date {
        match => ["eventTime", "ISO8601"]
        'remove_tag' => ['splitted']
        'add_tag' => ['cloudtrail']
      }
      ruby {
        'code' => '["responseElements","requestParameters"].each { |field| event[field] = event[field].inspect }  '
          }
    }
}

output {
  stdout { codec => rubydebug
   }
  elasticsearch {
    cluster => "logstash"
    host => "ES_server"
    embedded => "false"
    protocol => "http"
  }
}