input {
    tcp {
      port => 5000
      type => syslog
    }
    udp {
      port => 5001
      type => syslog
    }
}

filter {
    if [type] == "syslog" {
        grok {
        match => { "message" => "%{SYSLOG5424PRI}%{NONNEGINT:ver} +(?:%{TIMESTAMP_ISO8601:ts}|-) +(?:%{HOSTNAME:containerid}|-) +(?:%{NOTSPACE:containername}|-) +(?:%{NOTSPACE:proc}|-) +(?:%{WORD:msgid}|-) +(?:%{SYSLOG5424SD:sd}|-|) +%{GREEDYDATA:msg}" }
        }
        syslog_pri { }
        date {
        match => [ "syslog_timestamp", "MMM  d HH:mm:ss", "MMM dd HH:mm:ss" ]
        }
        if !("_grokparsefailure" in [tags]) {
        mutate {
            replace => [ "@source_host", "%{syslog_hostname}" ]
            replace => [ "@message", "%{syslog_message}" ]
        }
        }
        mutate {
        remove_field => [ "syslog_hostname", "syslog_message", "syslog_timestamp" ]
        }
    }
}

output {
    elasticsearch { hosts => "elasticsearch:9200" }
    #stdout { codec => rubydebug }
}