homelab/lab/ansible/roles/logstash/files/logstash.yml

input {
  beats {
    port => 5044
  }
}

filter {
  if "json" in [tags] {
    json {
      source => "message"
      target => "json"
    }
  }
}

output {
  elasticsearch {
    hosts => ["http://elastic.service:9200"]
    index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
    #user => "elastic"
    #password => "changeme"
  }
}