input {

    file {
#    start_position => "beginning"
    path => "C:/smarts/events/smarts*.txt"
    start_position => "end"
    codec => "json"
	sincedb_path => "C:/logstash/smarts.sincedb"
	tags => "smarts"
  }

    udp {
	  codec => plain {
	    charset => "ISO-8859-1"
	  }
	  host => "10.20.16.198"
	  port => 5514
	  tags => "syslog"
	  #debug => true
	  workers => 2
	  queue_size => 10000
	}

	udp {
	  codec => plain {
	    charset => "ISO-8859-1"
	  }
	  host => "10.20.16.198"
	  port => 515
	  tags => "aaa"
	  #debug => true
	  workers => 1
	  queue_size => 10000
	}

	tcp {
		host => "10.20.16.198"
		port => 81

	}
}

filter {
 if ("aaa" in [tags]){
  # Match only messages from Cisco ACS. Capture the header & message ignoring
  # the sequence numbers, and tag it. The clue is the "CSCOacs_*" string

  grok {
    match => [ "message","(?<acs_header><%{POSINT}>%{CISCOTIMESTAMP:cisco_timestamp} %{HOSTNAME:acs_server} CSCOacs_%{DATA:acs_type} )%{INT:acs_messageid} %{INT:number_of_lines} %{INT:line_number} %{GREEDYDATA:acs_message}"]
  }

  # Multiline filter only acts on message so copy the captured message in
  mutate {
    replace => [ "message", "%{acs_message}" ]
  }
  # Any message not beginning with a datestamp should be joined to the
  # previous line
  multiline {
    pattern => "^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}.\d{3}"
    negate => true
    what => "previous"
	stream_identity => "%{acs_server}"
  }

 }
}


output {

#if ( "aaa" in [tags] ) {
#
#  stdout {
#	debug => true
#	debug_format => "ruby"
#    # only emit events with the 'metric' tag
#    tags => "metric"
#    message => "rate: %{events.rate_1m}"
#	}
#  }


 if ( "syslog" in [tags] ) {
  rabbitmq {
	exchange => "logstash.syslog.co1"
    exchange_type => "direct"
    host => "gns-redis"
    port => "5672"
	workers => 2
  }
 }

 if ( "aaa" in [tags] ) {
  rabbitmq {
	exchange => "logstash.aaa.co1"
    exchange_type => "direct"
    host => "gns-redis"
    port => "5672"
	workers => 2
  }
 }

 if ( "smarts" in [tags] ) {
    rabbitmq {
	exchange => "logstash.smarts.co1"
    exchange_type => "direct"
    host => "gns-redis"
    port => "5672"
	workers => 2

  }
 }
}