# This file is managed by Chef

filter {
  if [type] == "syslog" {
    grok {
      match => {
        "message" => "%{ET_SYSLOGBASE} +%{GREEDYDATA:message}"
      }
    }

    date {
      match => ["timestamp", "ISO8601"]
      remove_field => ["timestamp"]
    }
  }
}
