container.training/elk/logstash.conf

input {
  # Listens on 514/udp and 514/tcp by default; change that to non-privileged port
  syslog { port => 51415 }
  # Default port is 12201/udp
  gelf { }
  # This generates one test event per minute.
  # It is great for debugging, but you might
  # want to remove it in production.
  heartbeat { }
}
# The following filter is a hack!
# The "de_dot" filter would be better, but it
# is not pre-installed with logstash by default.
filter {
  ruby {
    code => "
      event.to_hash.keys.each { |k| event[ k.gsub('.','_') ] = event.remove(k) if k.include?'.' }
    "
  }
}
output {
  elasticsearch {
    hosts => ["elasticsearch:9200"]
  }
  # This will output every message on stdout.
  # It is great when testing your setup, but in
  # production, it will probably cause problems;
  # either by filling up your disks, or worse,
  # by creating logging loops! BEWARE!
  stdout {
    codec => rubydebug
  }
}