input { file { type => "nginx_access" path => "/var/log/nginx/symfony_access.log" start_position => beginning } file { type => "symfony_dev" path => "/var/www/symfony/var/log/dev.log" start_position => beginning } file { type => "symfony_prod" path => "/var/www/symfony/var/log/prod.log" start_position => beginning } } filter { if [type] == "nginx_access" { grok { patterns_dir => "./patterns" match => { "message" => "%{NGINXACCESS}"} } } else if [type] in ["symfony_dev", "symfony_prod"] { grok { patterns_dir => "./patterns" match => { "message" => "%{SYMFONY}"} } } } output { elasticsearch { host => "localhost" cluster => "logstash" } }