input {
        azureeventhub {
                key => "KEY1"
                username => "USERNAME1"
                namespace => "NAMESPACE1"
                eventhub => "loggingeventhub"
                partitions => 4
                codec => "json"
                type => "production"
    }
        azureeventhub {
                key => "KEY2"
                username => "USERNAME2"
                namespace => "NAMESPACE2"
                eventhub => "loggingeventhub"
                partitions => 4
                codec => "json"
                type => "develop"
    }
}

filter {
        ruby {
                code => " if event['message']
                          event['message'] = event['message'].gsub('\q','q')
                          event['message'] = event['message'].gsub('\x','Xx')
                          event['message'] = event['message'].gsub('\\x','XXx')
                          event['message'] = event['message'].gsub('Xx5c','\\')
                          end
                        "
        }

        json {
            source => "message"
        }
}

output {
        if [type] == "production" {
                elasticsearch {
                        hosts => ["localhost:9200"]
                        user => "ESUSER"
                        password => "ESPASS"
                        index => "production-%{+YYYY.MM.dd}"
                }
        }
        else if [type] == "baas_qa" {
                elasticsearch {
                        hosts => ["localhost:9200"]
                        user => "ESUSER"
                        password => "ESPASS"
                        index => "develop-%{+YYYY.MM.dd}"
                }
        }

        } else {
                file {
                        path => "/var/log/logstash/output"
                }
        }
}