input {
  redis {
    host => "127.0.0.1"
    # these settings should match the output of the agent
    data_type => "list"
    key => "logstash"

    # We use the 'json' codec here because we expect to read
    # json events from redis.
    codec => json
  }
}





filter {

    multiline {
     negate => true
      pattern => "^%{TIMESTAMP_ISO8601} "
      what => "previous"
      stream_identity => "%{host}.%{filename}"
    }
    multiline {
      negate => false
      pattern => "^%{TIMESTAMP_ISO8601}%{SPACE}%{NUMBER}?%{SPACE}?TRACE"
      what => "previous"
      stream_identity => "%{host}.%{filename}"
    }
    grok {
      # Do multiline matching as the above mutliline filter may add newlines
      # to the log messages.
      # TODO move the LOGLEVELs into a proper grok pattern.
      match => { "message" => "(?m)^%{TIMESTAMP_ISO8601:logdate}%{SPACE}%{NUMBER:pid}?%{SPACE}?(?<loglevel>AUDIT|CRITICAL|DEBUG|INFO|TRACE|WARNING|ERROR) \[?\b%{NOTSPACE:module}\b\]?%{SPACE}?%{GREEDYDATA:logmessage}?" }
      add_field => { "received_at" => "%{@timestamp}" }
    }

#  if ! ("_grokparsefailure" in [tags]) {
    date {
      match => [ "logdate",
                 "yyyy-MM-dd HH:mm:ss.SSS",
                 "yyyy-MM-dd HH:mm:ss,SSS",
                 "yyyy-MM-dd HH:mm:ss",
                 "MMM  d HH:mm:ss",
                 "MMM dd HH:mm:ss",
                 "dd/MMM/yyyy:HH:mm:ss Z",
                 "yyyy-MM-dd HH:mm:ss.SSSZ",
                 "E MMM dd HH:mm:ss yyyy Z",
                 "E MMM dd HH:mm:ss yyyy"
               ]
    }

#     mutate {
#       replace => { "message" => "%{logmessage}" }
#     }
#     mutate {
#       remove_field => [ "logdate", "logmessage" ]
#     }

#  }
}









output {
#  stdout { debug => true debug_format => "json"}

#  elasticsearch_http {
#    host => "localhost"
#    codec => json
#  }

  elasticsearch {
    host => "127.0.0.1"
  }


}