BrainLogs.config

# This Logstash config file processes TheBrain's log files
# and passes their contents over to Elasticsearch

input {
	file {
		path => "C:/Users/{INSERT_USERNAME}/AppData/Local/TheBrain/Logs/Archive/*.log"
		start_position => "beginning"
		sincedb_path => "NUL"
		codec => multiline {
			charset => "Windows-1252"
 			pattern => "^%{TIMESTAMP_ISO8601} "
			negate => true
			what => "previous"
		}
	}
}

filter {

	grok {
		match => { "message" => "%{TIMESTAMP_ISO8601:logdate}%{SPACE}\|%{SPACE}%{WORD:category}%{SPACE}\|%{SPACE}%{GREEDYDATA:event_source}%{SPACE}\|%{SPACE}\[%{INT:event_code}\]%{SPACE}%{GREEDYDATA:event_message}" }
	}

	date {
		locale => "EN"
		timezone => "UTC"
		match => [ "logdate", "yyyy-MM-dd HH:mm:ss.SSSS" ] #2019-03-30 06:01:39.3161
		target => "@timestamp"
	}
}

output {
	elasticsearch {
		hosts => "localhost:9200"
		index => "brain_logs"
	}
	stdout {}
}