indexing.conf

input {
  file {
    type => "syslog"
    path => ["/var/log/auth.log", "/var/log/syslog"]
    #start_position => beginning
    #sincedb_path => "/dev/null"
  }
}

filter {
  if [type] == "syslog" {
    grok {
      match => {
        "message" => ["%{SYSLOGPAMSESSION}", "%{CRONLOG}", "%{SYSLOGLINE}"]
      }
      # After we processed the log we don't need the raw message anymore
      overwrite => "message" 
    }

    date {
      match => ["timestamp", "MMM  d HH:mm:ss", "MMM dd HH:mm:ss"]
      remove_field => ["timestamp"]
    }

    date {
      match => ["timestamp8601", "ISO8601"]
      remove_field => ["timestamp8601"]
    }
  }
}

output {
  stdout {
    codec => rubydebug
  }
}