logstash

{
    kibana: {
        webserver_listen: "0.0.0.0",
        webserver: "nginx",
        install_type: "file"
    },
    logstash: {
        supervisor_gid: 'adm',
        agent: {
            server_ipaddress: '127.0.0.1',
            xms: '128m',
            xmx: '128m',
            enable_embedded_es: false,
            inputs: [
              file: {
                type: 'syslog',
                path: ['/var/log/syslog','/var/log/messages'],
                start_position: 'beginning'
              }
            ],
            filters: [
              {
                condition: 'if [type] == "syslog"',
                block: {
                  grok: {
                    match: [
                      "message",
                      "%{SYSLOGTIMESTAMP:timestamp} %{IPORHOST:host} (?:%{PROG:program}(?:\[%{POSINT:pid}\])?: )?%{GREEDYDATA:message}"
                    ]
                  },
                  date: {
                    match: [
                      "timestamp",
                      "MMM  d HH:mm:ss",
                      "MMM dd HH:mm:ss",
                      "ISO8601"
                    ]
                  }
                }
              },
              {
                grok: { match: [ "message", "test"], type: 'foo' }
              }
            ],
            outputs: [
              {
                condition: 'if [type] == "syslog"',
                block: {
                  tcp: { host: '127.0.0.1', port: '5959'}
                }
              },
              {
                tcp: { host: '127.0.0.1', port: '6060', type: 'foo' }
              }
            ]
        },
        server: {
            xms: '128m',
            xmx: '128m',
            enable_embedded_es: true,
            config_templates: ['apache'],
            config_templates_variables: { apache: { type: 'apache' } },
            web: { enable: true }
        }
    }
}

logstash.conf

# This file was created for logstash
# by Chef
# Manual changes will be lost
input {

      file {
        'path' => ['/var/log/syslog', '/var/log/messages']
        'start_position' => 'beginning'
        'type' => 'syslog'
      }
}

filter {

    if [type] == "syslog" {
      grok {
        'patterns_dir' => '/opt/logstash/agent/etc/patterns'
        'match' => ['message', '%{SYSLOGTIMESTAMP:timestamp} %{IPORHOST:host} (?:%{PROG:program}(?:[%{POSINT:pid}])?: )?%{GREEDYDATA:message}']
      }
      date {
        'match' => ['timestamp', 'MMM  d HH:mm:ss', 'MMM dd HH:mm:ss', 'ISO8601']
      }
    }

      grok {
        'patterns_dir' => '/opt/logstash/agent/etc/patterns'
        'match' => ['message', 'test']
        'type' => 'foo'
      }
}

output {

    if [type] == "syslog" {
      tcp {
        'host' => '127.0.0.1'
        'port' => '5959'
      }
    }

      tcp {
        'host' => '127.0.0.1'
        'port' => '6060'
        'type' => 'foo'
      }
}