input { file { path => "/mnt/fileshare/logs/mongodb.log" ## sample csv file start_position => "beginning" sincedb_path => "/dev/null" } } filter { grok { match => { "message" => ["%{TIMESTAMP_ISO8601:timestamp}\s+%{NOTSPACE:severity}\s+%{NOTSPACE:component}\s+(?:\[%{DATA:context}\])?\s+%{GREEDYDATA:log_message}" ] } remove_field => "message" } mutate { add_field => { "read_timestamp" => "%{@timestamp}" } } } output { stdout { codec => rubydebug } elasticsearch { hosts => ["https://192.168.56.101:9200"] ## address of elasticsearch node index => "mongodb-log" user => "elastic" password => "enter-password-here" ssl => true cacert => "/usr/share/ca-certificates/elastic-ca.crt" ## Shared Elasticsearch CA certificate path } }