input {
  udp {
    host => "127.0.0.1:10514"
    codec => "json"
    type => "syslog"
  }
}

filter {
      if [type] == "syslog" {
        grok {
          match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" }
          add_field => [ "received_at", "%{@timestamp}" ]
          add_field => [ "received_from", "%{host}" ]
        }
        syslog_pri { }
        date {
          match => [ "syslog_timestamp", "MMM  d HH:mm:ss", "MMM dd HH:mm:ss" ]
        }
      }
    }
output {
     if [type] == "syslog" {
      elasticsearch {
        hosts => "127.0.0.1:9200"
        index => "logstash-%{+YYYY.MM.dd}"
      }
     }
    }