gistfile1.txt

filter {

  grok {
    'type' => 'syslog'
    'pattern' => ["<%{POSINT:syslog_pri}>%{TIMESTAMP_ISO8601:syslog_timestamp} (?:%{SYSLOGFACILITY} )?%{SYSLOGHOST:syslog_hostname} %{SYSLOGPROG:syslog_program}: %{GREEDYDATA:syslog_message}"]
    'add_field' => ["received_at", "%{@timestamp}"]
    'add_field' => ["received_from", "%{@source_host}"]
  }

  syslog_pri {
    'type' => 'syslog'
  }

  date {
    'match' => ["syslog_timestamp", "MMM  d HH:mm:ss", "MMM dd HH:mm:ss", "ISO8601"]
    'type' => 'syslog'
  }

  mutate {
    'type' => 'syslog'
    'exclude_tags' => '_grokparsefailure'
    'replace' => ["@source_host", "%{syslog_hostname}"]
    'replace' => ["@message", "%{syslog_message}"]
  }

  mutate {
    'remove' => ["syslog_hostname", "syslog_message", "syslog_timestamp"]
    'type' => 'syslog'
  }
}