# Where to get input
input {
  # NAGIOS input
  beats {
    port => 5044
    ssl => false
    tags => ["nagios"]
    type => "nagios"
  }
}

# Some Filtering
filter {
  #Nagios filter
  if [type] == "nagios" {
    grok {
      match => { "message" => "%{NAGIOSLOGLINE}" }
    }
  }
}

# Where to send output
output {
  # Send output to standard output device/interface
  stdout {
    codec => rubydebug
  }

  # Parse failed messages to separate index
  if "_grokparsefailure" in [tags] {
    elasticsearch {
    # host => ["localhost:9200"]
      host => ["ES_CONN_STR"]
      index => "cgidev-parse-err-%{+YYYY.MM.dd}"
      protocol  => "http"
      user => logstash
      password => logstash
    }
  }

# Elasticsearch output
  elasticsearch {
  # host => ["localhost:9200"]
    host => ["ES_CONN_STR"]
    index => "cgidev-logstash-%{+YYYY.MM.dd}"
    protocol  => "http"
    user => logstash
    password => logstash
  }
}