input {
    file {
        path => "/home/christian/Documents/ELK/pfa-gateway.log"
        start_position => "beginning"
        sincedb_path => "/dev/null"
    }

    stdin{}
}

filter {
    #split le message
    kv {
        field_split => " "
        source => "message"
    }

    #permet au timestamp d'avoir la meme date que celle des logs
     date {
        match => ["t","YYYY-MM-dd HH:mm:ss.SSS"]
    }

    if [took] {
        grok {
            match => [ "took", "%{NUMBER:duration}%{GREEDYDATA:unit}"]
        }
    }


    #converti la durée en type float
    mutate {
        convert => { "duration" => "float" }
    }

    #si la durée est en µs on la converti en ms
    if [unit] =~ /µs/ {
        ruby {
            code => "
                event['duration'] = event['duration']/1000
                event['unit'] = 'ms'
            "
            }
    }
}

output {
    stdout {
        codec => rubydebug
    }

    elasticsearch {
        hosts => "127.0.0.1"
        index => "logstash-pfa"
        user => "admin_orange"
        password => "admin_orange"
    }


}