input {
    file {
        path => "C:\ELK\logstash\data\b.log"
		start_position => beginning
        ignore_older => 0

		#This configuration uses the multiline codec to specify that any line that does not begin with a timestamp belongs to the previous line.
		codec => multiline {
			pattern => "^%{TIMESTAMP_ISO8601} "
			negate => true
			what => previous
		}

    }
}

filter {

	grok {
		patterns_dir => ["./patterns"]
		match => [ "message", "%{TIMESTAMP_ISO8601:timestamp}%{SPACE}%{FUSE:Fuse}%{SPACE}\[%{HOSTNAME:From}\]%{SPACE}(%{WORD:LogLevel}%{SPACE}\|%{SPACE}%{WORD:Operation}%{SPACE}\|%{SPACE}%{NOTSPACE:GUID}%{SPACE}\|%{SPACE}%{SENTENCE:Component}%{SPACE}\|%{SPACE}%{COMPLEX_WORD:Message})?(%{SPACE}%{COMPLEX_MESSAGE:Message})?(%{SPACE}\|%{SPACE}%{GREEDYDATA:XMLText})?" ]
        }

	#mutate {		remove_field => [ "message","@version","@timestamp","path","host","type","tags" ]    }

	#mutate {		remove_field => [ "@version","@timestamp","path","host","type","tags" ]    }

}

output {

	file { path => "C:\ELK\logstash\data\aout.log" }
	elasticsearch {
		hosts => ["localhost:9200"]
	}

  stdout {
  }
	#jdbc {
        #driver_class => "oracle.jdbc.driver.OracleDriver"
		#driver_jar_path => "C:\logstash-2.3.4\bin\ojdbc7.jar"
		#connection_string => "jdbc:oracle:thin:EI_APP/EI_APP@10.68.68.238:1521:OSBDB"
		#statement => [ "CALL EI_APP.INSERT_LOG_P(?, ?, ?, ?, ?, ?, ?, ?, ?)", "timestamp", "Fuse", "From", "LogLevel", "Operation", "GUID", "Component", "Message", "XMLText" ]
	#}

}