Untitled

input {

  udp { port => 514 }

  redis {

    host => "127.0.0.1"

    # these settings should match the output of the agent

    data_type => "list"

    key => "logstash"

 

    # We use the 'json' codec here because we expect to read

    # json events from redis.

    codec => json

  }

}

 

filter {

 grok {

  pattern => ['(?:%{SYSLOGTIMESTAMP:timestamp}|%{TIMESTAMP_ISO8601:timestamp8601}) (?:%{SYSLOGHOST:logsource}) (?:%{SYSLOGPROG}): (?<messagebody>(?:\[(?<esxi_thread_id>[0-9A-Z]{8,8}) %{DATA:esxi_loglevel} \'%{DATA:esxi_service}\'\] %{GREEDYDATA:esxi_message}|%{GREEDYDATA}))']

  type => "esxi"

 }

}

 

output {

  stdout { debug => true debug_format => "json"}

 

  elasticsearch {

    host => "127.0.0.1"

  }

}