logstash-filters.conf

filter {
  # standard rfc5424 parsing
  grok {
    match => [ "message", "%{SYSLOG5424LINE}" ]
  }

  syslog_pri {}

  mutate {
    rename => ["syslog5424_app", "job"]
  }
  mutate {
    rename => ["syslog5424_host", "host_address"]
  }
  date {
    match => [ "syslog5424_ts", "ISO8601" ]
    target => "@timestamp"
    remove_field => "syslog5424_ts"
  }

  # extract BOSH instance metadata from structured data
  if [syslog5424_sd] =~ "\[instance@47450" {
    grok {
      match => [ "syslog5424_sd", "\[instance@47450 %{DATA:source_raw}\]" ]
    }

    kv {
      source => "source_raw"
      target => "source"
      remove_field => "source_raw"
    }

    mutate {
      remove_field => "syslog5424_sd"
    }
  }

  if [syslog5424_msg] =~ /^{.*}/ {
    json {
      source => "syslog5424_msg"
      target => "parsed_json"
      remove_field => "syslog5424_msg"
      add_tag => [ "json" ]
    }

    date {
      match => ["[parsed_json][timestamp]", "ISO8601", "UNIX"]
      target => ["[parsed_json][timestamp]"]
    }
  }
}