gistfile1.txt

if [type] == "apache-access" or [type] == "apache-error" {
    geoip {
      source => "clientip"
      database => "/opt/logstash/vendor/geoip/GeoLiteCity.dat"
    }
    if [agent] != "-" {
      useragent {
        source => "agent"
        target => "ua"
        add_tag => [ "UA" ]
        regexes => "/etc/logstash/regexes.yaml"
      }
    }

    if [type] == "apache-access" {
      grok {
        match => [ "message", "%{COMBINEDAPACHELOG}" ]
      }
    }
    else if [type] == "apache-error" {
      grok {
        patterns_dir => [ "/etc/logstash/patterns.d" ]
        match => [ "message", "%{APACHE_ERROR_LOG}" ]
      }

      if !("_grokparsefailure" in [tags]) {

        mutate {
          remove_field => [ "message" ]
          add_field =>  ["timestamp_submitted", "%{@timestamp}"]
        }

        date {
          # Try to pull the timestamp from the 'timestamp' field (parsed above with
          # grok). The apache time format looks like: "18/Aug/2011:05:44:34 -0700"
          #                        Sat Feb 08 06:31:09 2014
          match => [ "timestamp", "EEE MMM dd HH:mm:ss yyyy" ]
          remove_field => [ "timestamp" ]
        }
      }
    }
  }