logstash.conf

input {
    tcp {
        port => 9514
        type => syslog
    }
    udp {
        port => 9514
        type => syslog
    }
    gelf {
        port => 12201
        type => gelf
    }
}

filter {
    if [type] == "syslog" {
        grok {
            match => { "message" => "<%{POSINT:syslog_pri}>%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:[%{POSINT:syslog_pid}])?: %{GREEDYDATA:syslog_message}" }
            add_field => [ "received_at", "%{@timestamp}" ]
                add_field => [ "received_from", "%{host}" ]
        }
        syslog_pri { }
        date {
            match => [ "syslog_timestamp", "MMM  d HH:mm:ss", "MMM dd HH:mm:ss" ]
        }
        if !("_grokparsefailure" in [tags]) {
            mutate {
                replace => [ "@source_host", "%{syslog_hostname}" ]
                replace => [ "@message", "%{syslog_message}" ]
            }
        }
        mutate {
            remove_field => [ "syslog_hostname", "syslog_message", "syslog_timestamp" ]
        }
    }
}

output {
  elasticsearch {
    hosts => ["localhost:9200"]
    workers=> 2
  }
}