logstash.conf

backend.conf

input {
  udp {
    type => "backend"
    port => 5000
    codec => multiline {
   	pattern => "^\w+\s+\w+\s+[0-9]{4}-[0-9]{2}-[0-9]{2}\s[0-9]{2}:[0-9]{2}:[0-9]{2}.*$"
   	negate => "true"
      	what => "previous"
    }
  }

  file {
    type => "syslog"
    path => [ "/var/log/*.log", "/var/log/messages", "/var/log/syslog" ]
    start_position => "beginning"
  }
}

filter {
 
  grok {
    # check that fields match your IIS log settings
    match => ["message", "%{WORD:deployment} %{WORD:tenant} {1,20}%{TIMESTAMP_ISO8601:log_timestamp} (?<thread>\[.*\]) %{WORD:level} {1,3}- (?<mainmessage>.*$)"]
  }
  
  #Set the Event Timesteamp from the log
  date {
    match => [ "log_timestamp", "YYYY-MM-dd HH:mm:ss,SSS" ]
	  timezone => "Etc/UCT"
  }

  mutate {
	remove_field => [ "remove" ]
  }
}
 
output {

  elasticsearch {
    embedded => true
  }
}

gistfile1.txt

input {
  udp {
    type => "backend"
    port => 5000
    codec => multiline {
   	pattern => "^\w+\s+\w+\s+[0-9]{4}-[0-9]{2}-[0-9]{2}\s[0-9]{2}:[0-9]{2}:[0-9]{2}.*$"
   	negate => "true"
      	what => "previous"
    }
  }

  file {
    type => "syslog"
    path => [ "/var/log/*.log", "/var/log/messages", "/var/log/syslog" ]
    start_position => "beginning"
  }
}

filter {
 
  grok {
    # check that fields match your IIS log settings
    match => ["message", "%{WORD:deployment} %{WORD:tenant} {1,20}%{TIMESTAMP_ISO8601:log_timestamp} (?<thread>\[.*\]) %{WORD:level} {1,3}- (?<mainmessage>.*$)"]
  }
  
  #Set the Event Timesteamp from the log
  date {
    match => [ "log_timestamp", "YYYY-MM-dd HH:mm:ss,SSS" ]
	  timezone => "Etc/UCT"
  }

  mutate {
	remove_field => [ "remove" ]
  }
}
 
output {

  elasticsearch {
    embedded => true
  }
}