01 logstash-irc.conf

input {
	irc {
		channels => "#mychan"
		host => "chat.freenode.net"
		nick => "ivor_bigun"
		catch_all => true
	  get_stats => true
	}
}

output {
	stdout { codec => "rubydebug" }
	elasticsearch {
					hosts => "localhost"
					index => "logstash-irc-%{+YYYY.MM.dd}"
	}
}

02 logstash-irc-kafka.conf

input {
	irc {
		channels => "#obihackers"
		host => "chat.freenode.net"
		nick => "ivor_bigun"
		catch_all => true
	get_stats => true
	}
}

output {
	stdout { codec => "rubydebug" }
  kafka  { topic_id => "irc" 
        		bootstrap_servers => "localhost:2181"
         }
}

03 logstash-kafka-es.conf

input {
    kafka {
        zk_connect => 'localhost:2181'
        topic_id => 'irc'
    		consumer_id => "test01"
		    auto_offset_reset => "smallest"
    }
}

output {
	stdout { codec => "rubydebug" }
	elasticsearch {
					hosts => "localhost"
					index => "logstash-irc-%{+YYYY.MM.dd}"
	}
}

04 logstash-kafka-es-02.conf

input {
    kafka {
        zk_connect => 'localhost:2181'
        topic_id => 'irc'
    		consumer_id => "test02-geoip-test"
		    auto_offset_reset => "smallest"
    }
}

filter {
	if (! ([geoip] =~ /.+/ )) and ([host] =~ /.+/) {
		grok { match => ["host","%{IP:host}"] 
	                tag_on_failure => []
			overwrite => [ "host" ]
			}
		geoip { source => "host"
					}
	}
}

output {
	stdout { codec => "rubydebug" }
}