evision_adds_logstash

gistfile1.txt

 Set-ExecutionPolicy Bypass -Scope Process -Force; iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1'))

 choco feature enable -n=allowGlobalConfirmation

 choco install logstash --version 6.2.4

 choco feature disable -n=allowGlobalConfirmation

 $env:Path = [System.Environment]::GetEnvironmentVariable("Path","Machine") + ";" + [System.Environment]::GetEnvironmentVariable("Path","User") 

 $config = @"
input { 
  file {
     path => "C:/CustomLogs/*.log"
     start_position => "beginning"
     codec => multiline {
      pattern => "^%{TIMESTAMP_ISO8601} "
      negate => true
      what => "previous"
    }
  } 
}
filter {
  grok {
    match => ["message", "%{TIMESTAMP_ISO8601:tstamp} \[%{WORD:threadId}\] %{WORD:level} %{NOTSPACE:classname} \[%{NOTSPACE:context}?\] (\-)? %{DATA:msg}"]
  }
  date {
    match => ["tstamp", "ISO8601"]
  }
}
output {
  elasticsearch {
     hosts => ["vpc-pv8logging-qeckbwdfcejy2eui4t2bt2euza.eu-west-1.es.amazonaws.com:80"]
     index => "evision"
  }
  stdout {  }
}
"@

 $logstashPath = 'C:\ProgramData\chocolatey\lib\logstash\tools\logstash-6.2.4\bin\'

 $configPath = $logstashPath + '\config.json'
$exePath = $logstashPath + '\logstash.bat'

 Out-File -FilePath $configPath -InputObject $config -Encoding ASCII 

 iex "$exePath -f $configPath"