logstash.conf

gistfile1.txt

input {
  file {
    path => "buildserver/teamcity-server.log*"
    codec => multiline {
      charset => "ISO-8859-1"
      pattern => "^\[%{TIMESTAMP_ISO8601}\]"
      negate => true
      what => previous
    }
    start_position => beginning
    sincedb_path => "logstash/data/since.db"
  }
}

filter {
  if [message] =~ /- \n\n\n\n\n\n \r$/ {
    drop { }
  }
  grok {
    match => [ "message", "^\[%{TIMESTAMP_ISO8601:timestamp}\] %{SPACE}%{LOGLEVEL:level} - %{SPACE}%{DATA:component} - %{GREEDYDATA:message} " ]
    overwrite => "message"
  }
  date {
    match => ["timestamp", "yyyy-MM-dd HH:mm:ss,SSS"]
    remove_field => "timestamp"
  }

  grok {
    match => ["message", "^Build started; %{DATA:build_type} {%{DATA} {build id=(?<build_id>\d+)"]
    add_tag => [ "buildStarted" ]
    tag_on_failure => []
  }
  grok {
    match => ["message", "^Finished build %{DATA:build_type} {%{DATA} {build id=(?<build_id>\d+)"]
    add_tag => [ "buildFinished"]
    tag_on_failure => []
  }
  elapsed {
    start_tag => "buildStarted"
    end_tag => "buildFinished"
    unique_id_field => "build_id"
  }
}

output {
  elasticsearch {
    host => localhost
    protocol => transport
  }
}