input {
  file {
    type => "varnishncsa"
                path => "/var/log/varnish/varnishncsa*"
    exclude => "*.gz"
    start_position => beginning
    sincedb_path => "/var/tmp/.sincedb"
    debug => true
  }
}

output {
  redis { host => "elasticlog01.example.dk" data_type => "list" key => "logstash" }
  stdout {
        debug => true
  }
}

filter {
  grok {
    type => "varnishncsa"
    #logstash <1.2
    pattern => ["\[%{DATA:time}\] %{WORD:method} %{DATA:url} %{NOTSPACE:protocol} %{NUMBER:returncode} %{NOTSPACE:bytes} %{NUMBER:time_firstbyte} %{WORD:handling} %{IP:client}", "\[%{DATA:time}\] %{WORD:method} %{DATA:url} %{NOTSPACE:protocol} %{NUMBER:returncode} %{NOTSPACE:bytes} %{NUMBER:time_firstbyte} %{WORD:handling} -"]
    #logstash 1.2+
    #match => [ "message", "\[%{DATA:time}\] %{WORD:method} %{DATA:url} %{NOTSPACE:protocol} %{NUMBER:returncode} %{NUMBER:bytes} %{NUMBER:time_firstbyte} %{WORD:handling} %{IP:client}" ]
    # pattern:[11/Sep/2013:10:32:56 +0200] GET http://yousee.tv/amf_gateway/ HTTP/1.1 404 346 0.000017166 hit 87.50.52.240
    # created by: varnishncsa  -F '%t %r %s %b %{Varnish:time_firstbyte}x %{Varnish:handling}x %{X-Forwarded-For}i'
  }
  #make sure we use the timestamp in output as date for logentry
  date {
    type => "varnishncsa"
    locale => "en"
    time => "dd/MMM/YYYY:HH:mm:ss Z"
    #1.2+
    #match => [ "time_local" , "dd/MMM/YYYY:HH:mm:ss Z" ]
  }
}