lumberjack input (receiving java/tomcat logs)

gistfile1.txt

# logstash indexer.conf
input {
  lumberjack {
    ssl_certificate => "/u01/logstash/ssl/logstash.crt"
    ssl_key => "/u01/logstash/ssl/logstash.key"
    type => "lumberjack"
    port => 5959
  }
}

filter {
  multiline {
    pattern => "^\s"
    what => "previous"
  }
}

output {
  elasticsearch {
    host => "127.0.0.1"
  }
}

# lumberjack process on node:
/opt/lumberjack/bin/lumberjack.sh --host logstash --port 5959 --ssl-ca-path /etc/ssl/certs/logstash.crt \
/var/log/tomcat7/AppFoo.log /var/log/tomcat7/AppBar.log