logstash.conf

# See http://logstash.net/docs/latest/ for documentation on how to configure Logstash.

input {
    file {
     path => "/host/var/log/*access*.log"
     type => "apache"
	 sincedb_path => "/logstash/sincedb/since.db"
	 codec => multiline {
		pattern => "^%{IPORHOST} "
		negate => true
		what => previous
     }
    }
	file {
     path => "/host/var/log/*haproxy*.log"
     type => "haproxy"
	 sincedb_path => "/logstash/sincedb/since.db"
	 codec => multiline {
		pattern => "^%{SYSLOGTIMESTAMP} "
		negate => true
		what => previous
     }
    }
	file {
        path => "/host/var/log/*jboss*.log"
		type => "jboss"
		sincedb_path => "/logstash/sincedb/since.db"
        codec => multiline {
		  pattern => "^(%{YEAR}/%{MONTHNUM}/%{MONTHDAY} %{HOUR}:%{MINUTE}:%{SECOND}) "
		  negate => true
		  what => previous
		}
    }
    file {
        path => "/host/var/log/*.log"
		type => "default"
		sincedb_path => "/logstash/sincedb/since.db"
        codec => multiline {
		  pattern => "^%{TIMESTAMP_ISO8601} "
		  negate => true
		  what => previous
		}
    }
}

filter {
    if [type] == "apache" {
      grok {
        match => [
                      "message", "%{COMBINEDAPACHELOG}",
                      "path","%{GREEDYDATA}/%{GREEDYDATA:filename}\.log"
                 ]
        break_on_match => false
      }
	  date {
          match => [ "timestamp", "dd/MMM/yyyy:HH:mm:ss Z" ]
          target => ["datetime"]
      }
      ruby {
          code => "require 'date';
          event['Timestamp'] = DateTime.parse(event['datetime'].to_iso8601).strftime('%Y-%m-%d %H:%M:%S.%L')"
      }
	} else if [type] == "haproxy" {
         grok {
           match => [
                      "message", "%{HAPROXYHTTP}",
                      "path","%{GREEDYDATA}/%{GREEDYDATA:filename}\.log"
                   ]
                   break_on_match => false
         }
		 date {
           match => [ 'accept_date', 'dd/MMM/yyyy:HH:mm:ss.SSS']
           target => ["datetime"]
          }
         ruby {
           code => "require 'date';
           event['Timestamp'] = DateTime.parse(event['datetime'].to_iso8601).strftime('%Y-%m-%d %H:%M:%S.%L')"
          }
      } else if [type] == "jboss" {
         grok {
           match => [
                      "message", "(?<jtime>%{YEAR}/%{MONTHNUM}/%{MONTHDAY} %{HOUR}:%{MINUTE}:%{SECOND}) %{LOGLEVEL:level} (?<logmessage>(.|\r|\n)*)",
                      "path","%{GREEDYDATA}/%{GREEDYDATA:filename}\.log"
                   ]
                   break_on_match => false
         }
		 date {
           match => [ 'jtime', 'YYYY/MM/dd HH:mm:ss,SSS']
           target => ["datetime"]
          }
		 ruby {
           code => "require 'date';
           event['Timestamp'] = DateTime.parse(event['datetime'].to_iso8601).strftime('%Y-%m-%d %H:%M:%S.%L')"
          }
       } else if [type] == "default" {
        grok {
           match => [
             "message", "%{TIMESTAMP_ISO8601:Timestamp} %{LOGLEVEL:level} (?m)%{GREEDYDATA:logmessage}",
             "path","%{GREEDYDATA}/%{GREEDYDATA:filename}\.log"
           ]
          break_on_match => false
        }
      }	
}

output {
    redis { 
	    host => "redis" 
		data_type => "list" 
		key => "logstash-%{type}" 
		  }
}