DockerCon update

elk/logstash.conf

@@ -0,0 +1,34 @@
+input {
+  # Listens on 514/udp and 514/tcp by default; change that to non-privileged port
+  syslog { port => 51415 }
+  # Default port is 12201/udp
+  gelf { }
+  # This generates one test event per minute.
+  # It is great for debugging, but you might
+  # want to remove it in production.
+  heartbeat { }
+}
+# The following filter is a hack!
+# The "de_dot" filter would be better, but it
+# is not pre-installed with logstash by default.
+filter {
+  ruby {
+    code => "
+      event.to_hash.keys.each { |k| event[ k.gsub('.','_') ] = event.remove(k) if k.include?'.' }
+    "
+  }
+}
+output {
+  elasticsearch {
+    hosts => ["elasticsearch:9200"]
+  }
+  # This will output every message on stdout.
+  # It is great when testing your setup, but in
+  # production, it will probably cause problems;
+  # either by filling up your disks, or worse,
+  # by creating logging loops! BEWARE!
+  stdout {
+    codec => rubydebug
+  }
+}
+