logstash.conf

input {

  collectd {
     type => "collectd"
     host => "127.0.0.1"
     typesdb => [ "logstash-1.4.0/vendor/collectd/types.db" ]
  }

  file {
     type => "app-log"
     path => "/home/vagrant/app.log"  
     codec => plain { charset => "ISO-8859-1" }
  }
}

filter {
   if [type] == "app-log" {
   grok {
      patterns_dir => "./patterns"
      match => ["message","%{LOG_DATE:log_date} \[%{NOTSPACE:thread}\] %{LOGLEVEL:log_level} %{NOTSPACE:classname} %{GREEDYDATA:log_msg}"]
   }

   if [log_level] == "INFO" {
   grok {
      patterns_dir => "./patterns"
      match => ["log_msg", "- %{GREEDYDATA:msg}"]
   }

   date {
      match => ["log_date","dd-MM-YYYY HH:mm:ss.SSS"]
   }

   kv {
      field_split => "&"
      source => "msg"
   }

   if [classname] =~ /SellRequest$/ {
      mutate { add_tag => "sell" }
   } else if [classname] =~ /SearchRequest$/ {
      mutate { add_tag => "search" }
   }

   mutate {    
      remove_field => [ "msg" ]
   }  

   mutate {
      convert => [ "id", "integer" ]
   }
   mutate {
      convert => [ "price", "float" ]
   }

   mutate {
      split => [ "options", "|" ]
   }

   geoip {
      source => "ip"
      database => "./GeoLiteCity.dat"
   }

   useragent {
      source => "ua"
      target => "useragent"
   }
   }
   }
}

output {
  #stdout { codec => json }
  elasticsearch { }
}