lw_solr_syslog.conf

input {
  file {
    type => "syslog"
  	exclude => ["*.gz","*.zip","*.tgz"]
		# FYI - LogStash does not always recurse the directory hirearcy correctly on Windows
		# unless the path is all lowercase.
    path => [ "/var/log/system.log" ]
		sincedb_path => "/dev/null"
  	start_position => "beginning"
   }
}

# Add name=value pairs as fields
filter {
  if [type] == "syslog" {
    grok {
      match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}?: %{GREEDYDATA:syslog_message}" }     
      add_field => [ "received_at", "%{@timestamp}" ]
      add_field => [ "received_from", "%{host}" ]
    }
    
    date {
      match => [ "syslog_timestamp", "MMM  d HH:mm:ss", "MMM dd HH:mm:ss" ]
    }

    if !("_grokparsefailure" in [tags]) {
      mutate {
        replace => [ "source_host", "%{syslog_hostname}" ]
      }
    }
    
    mutate {
      remove_field => [ "syslog_hostname", "syslog_timestamp" ]
    }
  }
}

output {
  lucidworks_solr {
    collection_host => "localhost"
    collection_port => "8983"
    collection_name => "logstash_logs"
    field_prefix => "event_"
    force_commit => false
    flush_size => 100
    idle_flush_time => 1
  }
}