input {

tcp {

port => 514

type => 'f5-request'

}

}

filter {

if [type] == "f5-request" {

grok {

match => { "message" => "%{IP:clientip} \[%{HTTPDATE:timestamp}\] %{IP:virtual_ip} %{DATA:virtual_name} %{DATA:virtual_pool_name} %{DATA:server} %{NUMBER:server_port} \"%{DATA:path}\" \"(?:%{WORD:verb} %{NOTSPACE:request}(?: HTTP/%{NUMBER:httpversion})?|%{DATA:rawrequest})\" %{NUMBER:response:int} %{NUMBER:bytes:int} %{NUMBER:response_ms:int} %{QS:referrer} %{QS:agent}"}

}

geoip {

source => "clientip"

}

}

}

output {

elasticsearch {

hosts => ["192.168.214.130:9200"]

index => "f5-request-%{+YYYY.MM.dd}"

}

}