=======================================================================================
## /etc/logstash/conf.d/logstash.conf ##
# Inputs
input {
	udp {
		port => 10113
		type => "sonicwall"
	}
	udp {
		port => 10112
		type => "cisco"
	}
	beats {
		port => "10114"
	}
	udp {
		port => 9995
		codec => netflow {
			definitions => "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-codec-netflow-3.2.2/lib/logstash/codecs/netflow/netflow.yaml"
			versions => [5]
		}
		type => "netflow"
	}
}

# Filters
filter {
	if [type] == "sonicwall" {
		grok {
			match => ["message" , ".+sn=%{WORD:serial}.+time=\"%{YEAR}-%{MONTHNUM}-%{MONTHDAY}.%{TIME}.+fw=%{IP:FirewallWAN}.+pri=%{NONNEGINT:priority}.+m=%{NONNEGINT:message ID}(.+msg=%{QS:message})?.+n=%{NONNEGINT:message-count}.+src=%{IP:source}:%{NONNEGINT:source-port}:%{WORD:source-interface}.+dst=%{IP:destination}:%{NONNEGINT:destination-port}:%{WORD:destination-interface}.+proto=%{NOTSPACE:protocol}(.+op=%{INT:OpCode})?(.+sent=%{INT:sent})?(.+rcvd=%{INT:rcvd})?(.+dstname=%{HOSTNAME:destination-host})?(.+arg=%{NOTSPACE:destination-path})?(.+code=%{INT:code})?(.+Category=%{QS}.)?"]
			overwrite => ["message"]
		}
	}
}
# Outputs
output {
	if [type] == "sonicwall" {
		elasticsearch {
			index => "firewall"
			hosts => ["localhost:9200"]
		}
	}
	if [type] == "cisco" {
		elasticsearch {
			index => "switch"
			hosts => ["localhost:9200"]
		}
	}
	if [type] == "wineventlog" {
		elasticsearch {
			index => "server"
			hosts => ["localhost:9200"]

		}
	}
	if [type] == "netflow" {
		elasticsearch {
			index => "netflow"
			hosts => ["localhost:9200"]
		}
		stdout {}
	}
}

===============================================================================================================
## Results from sudo /usr/share/logstash/bin/logstash -t --path.settings /etc/logstash ##
cat /var/log/logstash/logstash-plain.log
[2017-02-08T14:13:58,157][INFO ][logstash.runner          ] Using config.test_and_exit mode. Config Validation Result: OK. Exiting Logstash