logstash.conf

input {
  tcp {
    port => 3333
    type => "apache_access"
  }
  beats {
    port => 5044
  }
}

filter {
  mutate {
    add_field => [ "host_ip", "%{host}" ]
  }

  # Uncomment the remainder of the line to allow the "datadumpbeat" to
  # be managed in a similar way to normal Apache logs

  if [type] == "apache_access" # or [type] == "datadumpbeat"
  {
    grok {
      match => {
        message => "%{IPORHOST:remote_addr} - - \[%{HTTPDATE:timestamp}\] \"%{WORD:http_method} %{NOTSPACE:request} HTTP/%{NUMBER:http_version}\" %{NUMBER:status} (?:%{NUMBER:bytes}|-) \"(?:%{URI:referrer}|-)\" %{QS:user_agent}"
      }
    }

    date {
      locale => "en"
      match => ["timestamp", "dd/MMM/yyyy:HH:mm:ss Z"]
    }

    mutate {
      remove_field => "timestamp"
      gsub => [
        "user_agent", "(^\"|\"$)", ""
      ]
    }

    useragent {
      source => "user_agent"
      prefix => "user_agent_"
    }

    geoip {
      source => "remote_addr"
      target => "geoip"
      database =>"/usr/local/share/data/GeoLite2-City.mmdb"
      add_field => [ "[geoip][coordinates]", "%{[geoip][longitude]}" ]
      add_field => [ "[geoip][coordinates]", "%{[geoip][latitude]}"  ]
    }

    mutate {
      convert => [ "[geoip][coordinates]", "float" ]
    }
  }
}

# Uncomment for detailed logstash mapping information
# which can be viewed via `docker-compose logs -f logstash`
#
# output {
#   stdout { codec => rubydebug }
# }

output {
  elasticsearch {
    hosts => ["elastic1", "elastic2", "elastic3"]
    template => "/config-dir/logstash-es-template.json"
  }
}