input {
  tcp {
    port => 514
    type => syslog
  }
  udp {
    port => 514
    type => syslog
  }
}
filter {
  if [type] == "syslog" {
    grok {
      match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{NUMBER:request_time} %{IPORHOST:client_ip} \- (%{WORD:remote_user}|-) \[%{HTTPDATE:timestamp}\] \"(?:%{WORD:http_verb} %{NOTSPACE:http_request}(?: HTTP/%{NUMBER:http _version})?)\" %{NUMBER:http_status_code} (?:%{NUMBER:bytes_read}|-) %{QS:referrer} %{QS:agent} \"(%{IP:x_forwarder_for}|-)\"" }
    }
    kv {
      source => "http_request"
      prefix => "arg_"
      field_split => "&?"
      value_split => "="
      exclude_keys => [ "title", "content" ]
    }
    urldecode {
      field => "http_request"
    }
    mutate {
      remove_field => [ "message" ]
    }
    geoip {
      source => "client_ip"
    }
    syslog_pri { }
    date {
      match => [ "timestamp", "d/MMM/y:HH:mm:ss Z", "MMM  d HH:mm:ss", "MMM dd HH:mm:ss" ]
    }
  }
}
output {
  elasticsearch { 
    host => "elk-elasticsearch"
    protocol => "http"
 }
}