input {
  syslog {
    type => "syslog"
    port => 5544
    codec => multiline {
      pattern => "^%{LOGLEVEL}"
      negate => true
      what => "previous"
    }
  }
}

output {
  stdout { }
  elasticsearch { }
}