# This file is managed by Chef

filter {
  if [type] == "rails_app" {
    multiline {
      pattern => " Started "
      negate => true
      what => "previous"
    }

    grok {
      match => {
        "message" => "%{RAILS_APP}"
      }
    }

    date {
      match => ["timestamp", "ISO8601"]
      remove_field => ["timestamp"]
    }

    mutate {
      gsub => [
        # break the data field back into separate lines for clarity
        "data", "I, \[", "\nI, \["
      ]
    }
  }

  if [type] == "rails_basic" {
    grok {
      match => {
        "message" => "%{RAILS_APP_LINE}"
      }
    }

    date {
      match => ["timestamp", "ISO8601"]
      remove_field => ["timestamp"]
    }
  }
}
