td-agent.conf

<source>
  type tail
  format /^(?<ip>[^ ]*) [^ ]* (?<user>[^ ]*) \[(?<time>[^\]]*)\] (?<server>\S+) "(?<method>\S+)(?: +(?<path>[^ ]*) +\S*)?" (?<status>[^ ]*) (?<size>[^ ]*)(?: "(?<referer>[^\"]*)" "(?<user_agent>[^\"]*)")?$/
  time_format %d/%b/%Y:%H:%M:%S %z
  path /var/log/tdiary_access.log
  pos_file /var/log/td-agent/tdiary_access.log.pos
  tag tdiary.access
</source>

<match tdiary.access>
  type elasticsearch
  type_name access_log
  host [解析サーバのIPアドレス]
  port 9200
  logstash_format true
  include_tag_key true
  tag_key @log_name
</match>