filebeat:
  prospectors:
    - paths:
        - /data/dbdata/pg_log/*
      document_type: postgres
      input_type: log

  registry_file: /var/lib/filebeat/registry
output:
  logstash:
    hosts: ["10.29.31.132:5000"]
shipper:
logging:
  files:

cat /etc/logstash/conf.d/ingestion.conf
input {
    tcp {
        port => 5000
        codec => plain {
          charset => "ISO-8859-1"
      }
    }

    udp {
        port => 5000
    }

    #rabbitmq {
    #    durable => true
    #    host => "stg-ingestionrabbit101.ihrcloud.net"
    #    password => "s3ym0ur"
    #    prefetch_count => 50
    #    queue => "logstash"
    #    threads => 3
    #    type => "message"
    #    user => "ingestion"
    #    vhost => "/ingestion"
    #}
}

filter {
    if [type] == "postgres" {
      multiline {
      pattern => "^\s"
      what => "previous"
      }
  }
}
output {
    if [type] == "message" {
        elasticsearch {
            hosts => ["dev-ingelkes101.ihrcloud.net"]
            index => "message-%{+YYYY.MM}"
        }
    }

    if [type] == "postgres" {
        #elasticsearch {
            #hosts => ["dev-ingelkes101.ihrcloud.net"]
            #index => "syslogs-%{+YYYY.MM.DD}"
        #}
    #}
        file {
        path => "/tmp/syslogs-%{+YYYY.MM.DD}"
    }
  }
}