access.logstash.conf

input {
  rabbitmq {
    # ack => true
    subscription_retry_interval_seconds => 2
    durable => true
    host => "AMQPServer"
    vhost => "EnterpriseLog"
    queue => "ApplicationLog"
    port => 5672
    user => "logUser"
    password => "logPwd"
    passive => false
    prefetch_count => 10
    threads => 1
    # type => "Log"
  }
}

filter {

  date {
    match => [ "date", "yyyy-MM-dd HH:mm:ss Z" ]
    target => "date"
  }

  geoip {
    source => "ipv4"
  }

  useragent {
    source => "agent"
    target => "agent"
  }

}

output {
  elasticsearch {
    action => "index"
    codec => "json"
    # flush_size => ... # number (optional), default: 5000
    # idle_flush_time => ... # number (optional), default: 1
    hosts => ["elasticsearch"]
    index => "logstash-%{+YYYY.MM.dd}"
    document_type => "access"
    template_name => "logstash_template"
    template => "/config/logstash_template.json"
    # index_type => ... # string (optional)
    # manage_template => ... # boolean (optional), default: true
    # node_name => ... # string (optional)
    # port => ... # string (optional)
    # protocol => ... # string, one of ["node", "transport", "http"] (optional)
    # template_overwrite => ... # boolean (optional), default: false
    # workers => 2
  }
}