Feature: add rsyslog multiline logs

logstash/indexer/pipeline/kafka_elasticsearch.conf

@@ -23,6 +23,12 @@ input {
         topics => ["apache-forwarder"]
         client_id => "logstash_indexer_1"
 	}
+	kafka {
+        codec =>  json{}
+        bootstrap_servers => "kafka:9092"
+        topics => ["javalog"]
+        client_id => "logstash_indexer_1"
+	}
 }
 
 filter {
@@ -130,6 +136,12 @@ output {
 			index => "apache-%{+YYYYMM}"
         }
 	}
+	if [type] == "javalog" {
+        elasticsearch {
+			hosts => ["elasticsearch:9200"]
+			index => "javalog-%{+YYYYMM}"
+        }
+	}
 	if [type] == "random-forwarder" {
         elasticsearch {
 			hosts => ["elasticsearch:9200"]

logstash/shipper/pipeline/beat_kafka.conf

@@ -2,12 +2,33 @@ input {
   beats {
     port => 5044
   }
+  udp {
+    port => 10514
+    type => "syslog"
+  }
   lumberjack {
 	port => 5043
 	ssl_key => "/ssl/selfsigned.key"
 	ssl_certificate => "/ssl/selfsigned.crt"
   }
 }
+
+filter {
+  if [type] == "syslog" {
+    mutate {
+	  gsub => [ "message", "\t", "\\t" ]
+    }
+	if ![programname] {
+	  json {
+	  	source => "message"
+	  }
+	}
+	mutate {
+      replace => [ "type", "%{programname}" ]
+    }
+  }
+}
+
 output {
   kafka {
     codec => json