Feature: add rsyslog multiline logs

logstash/shipper/pipeline/beat_kafka.conf

@@ -2,12 +2,33 @@ input {
   beats {
     port => 5044
   }
+  udp {
+    port => 10514
+    type => "syslog"
+  }
   lumberjack {
 	port => 5043
 	ssl_key => "/ssl/selfsigned.key"
 	ssl_certificate => "/ssl/selfsigned.crt"
   }
 }
+
+filter {
+  if [type] == "syslog" {
+    mutate {
+	  gsub => [ "message", "\t", "\\t" ]
+    }
+	if ![programname] {
+	  json {
+	  	source => "message"
+	  }
+	}
+	mutate {
+      replace => [ "type", "%{programname}" ]
+    }
+  }
+}
+
 output {
   kafka {
     codec => json