# File /etc/syslog-ng/conf.d/elastic.conf
##########
# network sources
source s_net {
  udp(port(514));
  tcp(port(514));
  syslog();
};

##########
# patterndb parser
#parser pattern_db {
#  db-parser/
#    file("/path/to/patterndb.xml")
#  );
#};

##########
# Elasticsearch destination
destination d_es {
  elasticsearch2(
    client-lib-dir("/usr/share/elasticsearch/lib/:/usr/lib/syslog-ng/3.13/java-modules/")
    client-mode("http")
    index("syslog-ng_${YEAR}.${MONTH}.${DAY}")
    type("test")
    cluster("syslog")
    cluster-url("http://127.0.0.1:9200")
    template("$(format-json --scope rfc3164 --scope nv-pairs --exclude R_DATE --key ISODATE)\n")
    time-zone("UTC")
  );
};

###########
# sending logs to ES destionation
log {
  source(s_net);
  destination(d_es);
  flags(flow-control);
};