logstash.conf

input {
  stdin {
    type => "stdin-type"
  }
  syslog {
    type => syslog
    port => 5514
  }
  file {
    type => "logstash"
    path => [ "/var/log/logstash/logstash.log" ]
    start_position => "beginning"
  }
}

filter {
  if [type] == "docker" {
    json {
      source => "message"
    }
    mutate {
      rename => [ "log", "message" ]
    }
    date {
      match => [ "time", "ISO8601" ]
    }
  }
 grep {
   type => "syslog"
   match => [ "syslog_program", "drupal" ]
   add_tag => "Drupal"
   drop => false
  }
  grok {
    type => "syslog"
    tags => [ "Drupal" ]
    match => [ "@message", "^https?://%{HOSTNAME:drupal_vhost}\|%{NUMBER:drupal_timestamp}\|(?<drupal_action>[^\|]*)\|%{IP:drupal_ip}\|(?<drupal_request_uri>[^\|]*)\|(?<drupal_referer>[^\|]*)\|(?<drupal_uid>[^\|]*)\|(?<drupal_link>[^\|]*)\|(?<drupal_message>.*)" ]
  }
}

output {
  stdout {
    codec => rubydebug
  }

  elasticsearch {
    embedded => ES_EMBEDDED
    host => "ES_HOST"
    port => "ES_PORT"
    protocol => "http"
  }
}