input {
  syslog {
    type => "game_event"
  }
}

filter {
  grokdm {
     type => "game_event"
      pattern => [
    "php-cgi: v2 %{NOTSPACE:event} % %{NOTSPACE:game_id} % %{NOTSPACE:sn_id} % %{NOTSPACE:game_version} % %{NOTSPACE:player_id} % %{NOTSPACE:bck} %(?: %{NOTSPACE:arg1})?(?: % %{NOTSPACE:arg2})?(?: % %{NOTSPACE:arg3})?(?: % %{NOTSPACE:arg4})?(?: % %{NOTSPACE:arg5})?(?: % %{NOTSPACE:arg6})?(?: % %{NOTSPACE:arg7})?(?: % %{NOTSPACE:arg8})?",
	"php-cgi: v1 %{NOTSPACE:event} % %{NOTSPACE:game_id} % %{NOTSPACE:sn_id} % %{NOTSPACE:player_id} % %{NOTSPACE:bck} %(?: %{NOTSPACE:arg1})?(?: % %{NOTSPACE:arg2})?(?: % %{NOTSPACE:arg3})?(?: % %{NOTSPACE:arg4})?(?: % %{NOTSPACE:arg5})?(?: % %{NOTSPACE:arg6})?",
	"php-cgi: %{NOTSPACE:event} % %{NOTSPACE:game_id} % %{NOTSPACE:player_id} % %{NOTSPACE:bck} %(?: %{NOTSPACE:arg1})?(?: % %{NOTSPACE:arg2})?(?: % %{NOTSPACE:arg3})?(?: % %{NOTSPACE:arg4})?(?: % %{NOTSPACE:arg5})?(?: % %{NOTSPACE:arg6})?"
	]
 }
}

output {
  # Emit events to stdout for easy debugging of what is going through
  # logstash.
  # stdout { }

  # This will use elasticsearch to store your logs.
  # The 'embedded' option will cause logstash to run the elasticsearch
  # server in the same process, so you don't have to worry about
  # how to download, configure, or run elasticsearch!
  elasticsearch { embedded => true }

  #Disabled in test, enable for production
  #gelf {
  #	host => "graylog.2mundos.net"
  #	sender => "playerlogs"
  #	level => "info"
  #	facility => "logstash"
  #}
}