EIDA-logging.conf

## Read the input from TCP/5000
input {
        tcp {
                port => 5000
        }
}

## Add your filters
filter {
        grok {
                match => { "message" => "%{COMBINEDAPACHELOG}"}
        }
        date {
                match => [ "timestamp", "dd/MMM/yyyy:HH:mm:ss Z" ]
        }
        geoip {
                source => "clientip"
        }
        mutate {
                convert => ["response", "integer"]
                convert => ["bytes", "integer"]
        }
}

output {
        if [request] =~ /eidaws\/wfcatalog/ {
                elasticsearch {
                        hosts => "elasticsearch:9200"
                        index => "wfcatalog"
                }
        } else if [request] =~ /fdsnws\/dataselect/ {
                elasticsearch {
                        hosts => "elasticsearch:9200"
                        index => "dataselect"
                }
        } else if [request] =~ /fdsnws\/station/ {
                elasticsearch {
                        hosts => "elasticsearch:9200"
                        index => "station"
                }
        } else if [request] =~ /eidaws\/routing/ {
                elasticsearch {
                        hosts => "elasticsearch:9200"
                        index => "routing"
                }
        } else {
                elasticsearch {
                        hosts => "elasticsearch:9200"
                        index => "apache"
                }
        }
}