markwalkom

input {
  elasticsearch {
    hosts => [ "HOSTNAME_HERE" ]
    port => "9200"
    index => "INDEXNAME_HERE"
    size => 1000
    scroll => "5m"
    docinfo => true
    scan => true
  }