logstash.conf

input {
  tcp {
    port => 9000
    type => syslog
  }
  udp {
    port => 9000
    type => syslog
  }
}
filter {
  if [type] == "syslog" {
    grok {
      match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{WORD:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA}:message" }
      overwrite => "message" 
      add_tag => [ "SYSLOG" ]
      add_field => [ "received_at", "%{@timestamp}" ]
      add_field => [ "received_from", "%{host}" ]
    }
  }
if "_grokparsefailure" in [tags] { 
grok { 
patterns_dir => "/etc/logstash/patterns" 
match => [ "message", "%{OPENSTACK}" ] 
overwrite => "message" 
add_field => [ "syslog_message", "%{message}" ]
add_tag => [ "openstack" ] 
remove_tag => "_grokparsefailure" 
} 
}
if "_grokparsefailure" in [tags] {
grok {
patterns_dir => "/etc/logstash/patterns"
match => [ "message", "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{TIMESTAMP_ISO8601:logdate} %{PROG:syslog_pid} %{WORD:auditlevel} %{PROG:syslog_program} \[.*\] %{GREEDYDATA:message}" ]
overwrite => "message"
add_tag => [ "swift1" ]
remove_tag => "_grokparsefailure"
}
}
if "_grokparsefailure" in [tags] {
grok {
patterns_dir => "/etc/logstash/patterns"
match => [ "message", "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:message}" ]
overwrite => "message"
add_field => [ "syslog_message", "%{message}" ]
add_tag => [ "swift2" ]
remove_tag => "_grokparsefailure"
}
}

if "_grokparsefailure" in [tags] {
grok {
patterns_dir => "/etc/logstash/patterns"
match => [ "message", "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}: %{GREEDYDATA:message}" ]
overwrite => "message"
add_tag => [ "swift3" ]
remove_tag => "_grokparsefailure"
}
}
}
output {
  elasticsearch { host => elas }
  stdout { codec => rubydebug }
}