logstash.conf

input {
	file {
		id => "0"
		path => "/var/tmp/codechain/codechain.log.*"
		start_position => beginning
	}
}

filter {
	grok {
		match => {
			"message" => "#%{INSTANCE:instance}\s+%{TIMESTAMP:timestamp}\s+%{THREAD:thread}\s+%{LEVEL:level}\s+%{TARGET:target}\s+%{MESSAGE:message}"
		}
		overwrite => [ "message" ]
#		remove_field => [ "@timestamp" ]
		pattern_definitions => {
			"INSTANCE" => "\d+"
			"TIMESTAMP" => "\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}"
			"THREAD" => ".+"
			"LEVEL" => "OFF|ERROR|WARN|INFO|DEBUG|TRACE"
			"TARGET" => "[\w.]+"
			"MESSAGE" => ".*$"
		}
	}
	date {
		match => [ "timestamp", "yyyy-MM-dd HH:mm:ss" ]
		remove_field => [ "timestamp" ]
	}
}

output {
	elasticsearch {
		hosts => [ "localhost:9200" ]
	}
}