beats-to-elasticsearch.conf

input {
  beats {
    port => "5043"
  }
}

filter {
  if [tag] == "syslog" {
    grok {
      match => { "message" => "%{SYSLOGBASE} %{GREEDYDATA:message}" }
      overwrite => [ "message" ]
    }
  } else if [tag] == "postgres" {
    grok {
      match => { "message" => "%{TIMESTAMP_ISO8601:timestamp} %{TZ} (\[?)%{USER:user}(\]?)%{DATA}(\[?)%{WORD:database}(\]?) %{IP:host}\(%{INT:pid}\)%{WORD:level}:  %{GREEDYDATA:message}" }
      overwrite => [ "message" ]
    }
  }
  mutate {
    add_field => { "datacenter" => "dc1" }
  }
}

output {
  amazon_es {
    hosts => ["hosted.url.es.amazonaws.com"]
    region => "us-east-1"
    manage_template => "false"
    index => "logs-%{+YYYY.MM.dd}"
    flush_size => "7500"
  }
}