logstash template for Zenoss ControlCenter

logstash.json

{
   "ID": "",
   "Name": "Logstash (latest)",
   "Description": "Logstash",
   "Services": [
     {
       "Name": "Logstash (latest)",
       "Command": "",
       "Description": "Logstash",
       "Tags": null,
       "ImageID": "",
       "Instances": {
         "Min": 0,
         "Max": 0
       },
       "ChangeOptions": null,
       "Launch": "auto",
       "HostPolicy": "",
       "Hostname": "",
       "Privileged": false,
       "ConfigFiles": {},
       "Context": null,
       "Endpoints": null,
       "Services": [
         {
           "Name": "logstash",
           "Command": "/opt/logstash/bin/logstash",
           "Description": "",
           "Tags": [
             "daemon"
           ],
           "ImageID": "logstash:latest",
           "Instances": {
             "Min": 1,
             "Max": 0
           },
           "ChangeOptions": null,
           "Launch": "auto",
           "HostPolicy": "",
           "Hostname": "",
           "Privileged": false,
           "ConfigFiles": {
             "/etc/logstash/conf.d/logstash.conf": {
               "Filename": "/etc/logstash/conf.d/logstash.conf",
               "Owner": "root",
               "Permissions": "",
               "Content": "input {\n        tcp {\n                port => 5140\n                type => syslog\n        }\n}\n\nfilter {\n        grok {\n                match => [ 'message', '%{SYSLOGLINE}' ]\n                add_field => [ 'received_at', '%{@timestamp}' ]\n                add_field => [ 'received_from', '%{host}' ]\n        }\n        syslog_pri { }\n        date {\n                match => [ 'timestamp', 'MMM  d HH:mm:ss', 'MMM dd HH:mm:ss', 'ISO8601' ]\n        }\n        geoip {\n                add_tag => [ 'geoip' ]\n                source => 'clientip'\n        }\n}\n\noutput {\n        elasticsearch { host => 'localhost:9220' }\n}"
             }
           },
           "Context": null,
           "Endpoints": [
             {
               "Name": "logstash",
               "Purpose": "export",
               "Protocol": "tcp",
               "PortNumber": 5140,
               "PortTemplate": "",
               "VirtualAddress": "",
               "Application": "logstash",
               "ApplicationTemplate": "",
               "AddressConfig": {
                 "Port": 5140,
                 "Protocol": "tcp"
               },
               "VHosts": [
                 ""
               ]
             }
           ],
           "Services": [],
           "Tasks": null,
           "LogFilters": null,
           "Volumes": null,
           "LogConfigs": [
             {
               "Path": "/var/log/logstash/logstash.log",
               "Type": "system",
               "Filters": null,
               "LogTags": null
             }
           ],
           "Snapshot": {
             "Pause": "",
             "Resume": ""
           },
           "RAMCommitment": 136870912,
           "CPUCommitment": 0,
           "Runs": null,
           "Actions": {
             "status": "ps -ef | grep [l]ogstash"
           },
           "HealthChecks": {
             "running": {
               "Script": "echo $?",
               "Interval": 20
             }
           },
           "Prereqs": null,
           "MonitoringProfile": {
             "MetricConfigs": null,
             "GraphConfigs": null,
             "ThresholdConfigs": null
           },
           "MemoryLimit": 0,
           "CPUShares": 0,
           "PIDFile": ""
         }
       ],
       "Tasks": null,
       "LogFilters": null,
       "Volumes": null,
       "LogConfigs": null,
       "Snapshot": {
         "Pause": "",
         "Resume": ""
       },
       "RAMCommitment": 1073741824,
       "CPUCommitment": 2,
       "Runs": null,
       "Actions": null,
       "HealthChecks": null,
       "Prereqs": null,
       "MonitoringProfile": {
         "MetricConfigs": null,
         "GraphConfigs": null,
         "ThresholdConfigs": null
       },
       "MemoryLimit": 0,
       "CPUShares": 0,
       "PIDFile": ""
     }
   ],
   "ConfigFiles": null
 }