Aug15/16/18/21/22-12

input {
    beats {
        port => 5044
        ssl => true
        ssl_certificate => "/etc/logstash/logstash.crt"
        ssl_key => "/etc/logstash/logstash.key"
    }
}
filter {
    json {
        source => "message"
    }
    date {
        match => ["ts", "ISO8601"]
    }
    mutate {
        remove_field => ["ts","source","type","@version","beat","fields","offset","input_type","message","tags","host"]
        rename => { "fields[node]" => "node" }
    }
}
filter {
    geoip {
        source => "id.orig_h"
        database => "/root/geo.mmdb"
        target => "orig_h"
    }
    geoip {
        source => "id.resp_h"
        database => "/root/geo.mmdb"
        target => "resp_h"
    }
}
output {
    elasticsearch {
        hosts => ["localhost:9200"]
        document_type => "%{node}"
        document_id => "%{uid}"
    }
    rabbitmq {
        durable => true
        exchange => ""
        exchange_type => "direct"
        heartbeat => 60
        host => "localhost"
        key => "canids"
        persistent => false
        port => 5672
        user => "canids"
        password => "management"
        vhost => "/"
    }
}