docker-logstash.conf

logstash.conf

input {
  stdin {
    type => "stdin-type"
  }

  file {
    type => "apache-access"
    path => [ "/var/log/apache/access/*" ]
    start_position => "beginning"
  }

}

filter {
  if [type] == "apache-access" {
      grok {
        match => { "message" => "%{COMBINEDAPACHELOG}" }
      }
  }
  date {
    # Try to pull the timestamp from the 'timestamp' field (parsed above with
    # grok). The apache time format looks like: "18/Aug/2011:05:44:34 -0700"
    match => [ "timestamp", "dd/MMM/yyyy:HH:mm:ss Z" ]
  }
} 

output {
  stdout { 
    codec => rubydebug
  }

  elasticsearch {
    embedded => true
  }
}