logstash.conf

input {
	syslog {
		port => 5000
		type => "docker"
	}
}

filter {
	grok {
		match => { "message" => "%{SYSLOG5424PRI}%{NONNEGINT:ver} +(?:%{TIMESTAMP_ISO8601:ts}|-) +(?:%{HOSTNAME:service}|-) +(?:%{NOTSPACE:containerName}|-) +(?:%{NOTSPACE:proc}|-) +(?:%{WORD:msgid}|-) +(?:%{SYSLOG5424SD:sd}|-|) +%{GREEDYDATA:msg}" }
	}
	syslog_pri { }
	date {
		match => [ "syslog_timestamp", "MMM  d HH:mm:ss", "MMM dd HH:mm:ss" ]
	}
	mutate {
		remove_field => [ "message", "priority", "ts", "severity", "facility", "facility_label", "severity_label", "syslog5424_pri", "proc", "syslog_severity_code", "syslog_facility_code", "syslog_facility", "syslog_severity", "syslog_hostname", "syslog_message", "syslog_timestamp", "ver" ]
	}
	mutate {
		remove_tag => [ "_grokparsefailure_sysloginput" ]
	}
	mutate {
		gsub => [
			"service", "[0123456789-]", ""
		]
	}
	if [msg] =~ "^ *{" {
		json {
			source => "msg"
		}
		if "_jsonparsefailure" in [tags] {
			drop {}
		}
		mutate {
			remove_field => [ "msg" ]
		}
	}
	if ("ClientHost") {
		geoip {
			source => "ClientHost"
		}
	}
	DROP_NON_JSON
	if ("" in [msg]) {
		mutate {
			rename => { "msg" => "message" }
		}
	}
	mutate {
		remove_field => [ "tags" ]
	}
}

output {
	STDOUT
	elasticsearch {
		hosts => "ELASTICSEARCH_HOSTS"
		user => "ELASTICSEARCH_USER"
		password => "ELASTICSEARCH_PASSWORD"
	}
}