logstash.conf

input {
    stdin { }
}

filter {
    grok {
        match => {
          message => "<\d+>%{TIMESTAMP_ISO8601:timestamp} [^:]+[:] %{IP:client} %{GREEDYDATA}GMT%{SPACE}%{WORD:method}%{SPACE}%{URIPATHPARAM:path}%{SPACE}%{NUMBER:httpStatus}%{SPACE}%{URI:referer}"
        }
    }

    grok {
      match => [
        "path", "/gallery/%{GREEDYDATA:customer}/%{WORD:env}/%{GREEDYDATA}"
      ]
    }

    date {
      locale => "en"
      match => [ "timestamp", "ISO8601" ]
    }

    mutate {
      convert => {
        "httpStatus" => "integer"
      }

      remove_field => [
        "syslog5424_pri",
        "logsource",
        "host",
        "program",
        "pid",
        "timestamp8601"
      ]
    }
}
#
# output {
#   stdout {
#     codec => json
#   }
# }
#
output {
    elasticsearch {
        cluster => "elasticsearch.local"
        host => "127.0.0.1"
        protocol => http
        index => "logstash-5"
    }
}