all-log-types-logstash.conf

input {
    tcp {
        id => "tcp_5000"
        port => 5000
        codec => "json_lines"
    }
}

filter {
    if [type] == "iis" {
		# Convert IIS log time stamp to local time and send to @timestamp field
		date {
			id => "iis_timestamp"
			match => ["gmt_time", "yyyy-MM-dd HH:mm:ss"]
			timezone => "Etc/GMT"
		}

		useragent {
			id => "iis_useragent"
			source => "http_useragent"
			target => "http_agent"
		}
        
        geoip {
            id => "iis_add_src_ip_geoip"
            source => "src_ip"
            target => "src_ip_geoip"
            fields => ["country_name", "region_name", "city_name", "location", "continent_code"]
        }

		mutate {
			id => "iis_normalize_fields"
			lowercase => ["site_name"]
			remove_field => ["[http_agent][patch]"]
		}
	} else if [type] == "perfmon" {
        date {
            id => "perfmon_timestamp"
            match => ["EventTime", "MM/dd/yyyy HH:mm:ss.SSS"]
            timezone => "America/Los_Angeles"
            locale => "en"
            remove_field => ["EventTime"]
        }
    }
}

output {
    if [type] == "iis" {
        elasticsearch {
            id => "iis"
            hosts => ["127.0.0.1:9200"]
            index => "log_iis-%{+YYYY.MM}"
        }
    } else if [type] == "perfmon" {
        elasticsearch {
            id => "perfmon"
            hosts => ["127.0.0.1:9200"]
            index => "log_perfmon-%{+YYYY.MM}"
        }
    }
}