import_tsaclaims.conf

input { stdin { } }

filter {
	
    # DEFINE THE COLUMNS OF THE CSV
    csv {
        columns => ["Claim Number", "Date Received", "Incident Date", "Airport Code", "Airport Name", "Airline Name",
            "Claim Type", "Claim Site",	"Item Category", "CloseAmount", "Disposition"
        ]
        separator => ";"
    }

    # ATTEMPT TO MATCH DEPARTURE/DESTINATION WITH GEO COORDINATES
    #geoEnrich {
    #    database => "lookup_data/airports.csv"
    #    source => "Airport Code"
    #    target => "AirportGeoPoint"
    #}

    date {
        match => ["Date Received", 'd-M-y']
        target => "Date Received"
        locale => "en"
    }

    date {
        match => ["Incident Date", 'd-M-y']
        target => "Incident Date"
        locale => "en"
    }

    # CLOSING AMOUNT IS REPORTED IN CENTS, CONVERT TO DOLLARS
    ruby {
        code => " event['CloseAmount'] = event['CloseAmount'].to_i / 100 "
    }
}

output {
    elasticsearch {
        index => "tsaclaims"
        # Hosts defaults to localhost
        #hosts => ""
        #user => ""
        #password => ""
    }
    #stdout { codec => json }
}