syslog_server.conf

source s_net {                                                                                                                                                                                                  
udp(port(514)); syslog();                                                                                                                                                                                       
};                                                                                                                                                                                                              
                                                                                                                                                                                                                
######  # patterndb parser                                                                                                                                                                                      
parser pattern_db {                                                                                                                                                                                             
db-parser( file("/opt/syslog-ng/etc/patterndb.xml") );                                                                                                                                                          
};                                                                                                                                                                                                              
                                                                                                                                                                                                                
######  # Elasticsearch destination                                                                                                                                                                             
destination d_es {                                                                                                                                                                                              
        elasticsearch2 (                                                                                                                                                                                        
                cluster("syslog-ng")                                                                                                                                                                            
                client_mode("http")                                                                                                                                                                             
                index("syslog-ng_${YEAR}.${MONTH}.${DAY}")                                                                                                                                                      
                type("test")                                                                                                                                                                                    
                                                                                                                                                                                                                
                                                                        
  template("$(format-json --scope all-nv-pairs --exclude ISODATE --key ISODATE)")                                                                                                                               
        )                                                                                                                                                                                                       
};                                                                                                                                                                                                              
                                                                                                                                                                                                                
######  # sending logs to ES destination                                                                                                                                                                        
log {                                                                                                                                                                                                           
source(s_net);                                                                                                                                                                                                  
parser(pattern_db);                                                                                                                                                                                             
destination(d_es);                                                                                                                                                                                              
flags(flow-control);                                                                                                                                                                                            
};