logstash.conf

input {


 tcp {
    host => "149.202.191.163"
    port => 10514
    codec => "plain"
    type => "syslog"
    ssl_enable => true
    ssl_cert => "/etc/ssl/certs/server-cert.pem"
    ssl_key => "/etc/ssl/certs/server-key.pem"
    #ssl_extra_chain_certs => ["/etc/ssl/certs/ca-cert.pem"]
    ssl_verify => false
    #ssl_key_passphrase => "mention123@"
  }
}



filter {
if [type] == "syslog" {

  grok {
match => { "message" => "%{SYSLOGTIMESTAMP:TIME} %{SYSLOGHOST:hostname} %{DATA:dont_know} %{DATA:client} %{DATA:app_name}: %{GREEDYDATA:payload_message}"}
}

  json { source => "payload_message" }

  }
}

output {
    elasticsearch {
      hosts => [ "149.202.191.163:9200" ]
      index => "elk_mention-%{+YYYY.MM.dd}"
    }




 file{
   codec => line { format => "%{syslog_timestamp} %{hostname} %{app_name} %{payload_message}" }
   path => "/var/log/logstash/%{hostname}-%{+YYYY-MM-dd}.log"

}

}