input {
     beats {
           port => 5000
           ssl => true
           ssl_certificate => "/logstash.crt"
           ssl_key => "/logstash.key"
           }
}

filter {

    mutate { remove_field => ["[log][offset]", "[container][labels]", "[host][id]", "[host][architecture]", "[host][containerized]", "[host][os][family]", "[docker][container][labels][com_docker_compose_config-hash]", "[docker][container][labels][com_docker_compose_container-number]", "[docker][container][labels][com_docker_compose_oneoff]", "[docker][container][labels][com_docker_compose_version]", "[docker][container][labels][maintainer]", "[ecs][version]", "[agent]"] }

    if [container][image][name] =~ "nginx" {
           remove_field => "message"
    }

    mutate {
       remove_tag => ["beats_input_codec_plain_applied"]
       remove_tag => ["_geoip_lookup_failure"]
    }
  }

  if [container][image][name] !=~ "*nginx*" or [container][id] == "logs" {
    prune { whitelist_names => [ "@timestamp", "host", "container", "message", "tags", "log" ]}
  }
}

output {
     if [container][image][name] =~ "nginx" {
        elasticsearch {
                hosts => "http://elasticsearch:9200"
                user => "system"
                password => '111111'
                ilm_enabled => true
                template_overwrite => true
                ilm_rollover_alias => "nginx"
                ilm_policy => "nginx"
                }
        stdout { codec => json}
     }