Feb 26 17:56:58 debian9 logstash[1228]: {
Feb 26 17:56:58 debian9 logstash[1228]:               "syslog_pid" => "855",
Feb 26 17:56:58 debian9 logstash[1228]:     "syslog_severity_code" => 5,
Feb 26 17:56:58 debian9 logstash[1228]:          "syslog_facility" => "user-level",
Feb 26 17:56:58 debian9 logstash[1228]:     "syslog_facility_code" => 1,
Feb 26 17:56:58 debian9 logstash[1228]:           "syslog_program" => "logstash",
Feb 26 17:56:58 debian9 logstash[1228]:                  "message" => "Feb 26 17:32:54 debian9 logstash[855]:                 \"@version\" => \"1\",",
Feb 26 17:56:58 debian9 logstash[1228]:                     "type" => "syslog",
Feb 26 17:56:58 debian9 logstash[1228]:           "syslog_message" => "                \"@version\" => \"1\",",
Feb 26 17:56:58 debian9 logstash[1228]:          "syslog_severity" => "notice",
Feb 26 17:56:58 debian9 logstash[1228]:                     "path" => "/var/log/daemon.log",
Feb 26 17:56:58 debian9 logstash[1228]:            "received_from" => "debian9",
Feb 26 17:56:58 debian9 logstash[1228]:               "@timestamp" => 2017-02-26T16:32:54.000Z,
Feb 26 17:56:58 debian9 logstash[1228]:          "syslog_hostname" => "debian9",
Feb 26 17:56:58 debian9 logstash[1228]:         "syslog_timestamp" => "Feb 26 17:32:54",
Feb 26 17:56:58 debian9 logstash[1228]:              "received_at" => "2017-02-26T16:56:54.586Z",
Feb 26 17:56:58 debian9 logstash[1228]:                 "@version" => "1",
Feb 26 17:56:58 debian9 logstash[1228]:                     "host" => "debian9"
Feb 26 17:56:58 debian9 logstash[1228]: }