input {
  beats {
    port => 5044
  }
}
filter {
  if [system] or [monitor] {
    ruby {
      path => "/etc/logstash/resources_usage_alert.rb"
    }
  }
}
output {
  stdout { codec => rubydebug }   # for debugging
  if [@metadata][email_message] {
    email {
      to => "[email protected]"   # should be engineering
      from => "[email protected]"
      subject => "%{[@metadata][email_message][subject]}"
      body => "%{[@metadata][email_message][body]}"
      username => "[email protected]"
      password => "bvkwvalduscssuxy"
      use_tls => true
      port => 587
      address => "smtp.gmail.com"
      authentication => "plain"
      debug => true
    }
  }
  if [@metadata][beat] {
    elasticsearch {
      hosts => "localhost:9200"
      manage_template => false
      index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
      document_type => "%{[@metadata][type]}"
    }
  }
}