input {

stdin { }

}

filter {

grok {

match => {

"message" => '%{IPORHOST:clientip} %{USER:ident} %{USER:auth} \[%{HTTPDATE:timestamp}\] "%{WORD:verb} %{DATA:request} HTTP/%{NUMBER:httpversion}" %{NUMBER:response:int} (?:-|%{NUMBER:bytes:int}) %{QS:referrer} %{QS:agent}'

}

}

date {

match => [ "timestamp", "dd/MMM/YYYY:HH:mm:ss Z" ]

locale => en

}

geoip {

source => "clientip"

}

useragent {

source => "agent"

target => "useragent"

}

}

output {

stdout {

codec => dots {}

}

elasticsearch {

index => "apache_elastic_example"

template => "./apache_template.json"

template_name => "apache_elastic_example"

template_overwrite => true

}

}