input { udp { port => 5000 type => syslog codec => json } } filter { if [logger_name] =~ "metrics" { kv { source => "message" field_split => ", " prefix => "metric_" } mutate { convert => { "metric_value" => "float" } convert => { "metric_count" => "integer" } convert => { "metric_min" => "float" } convert => { "metric_max" => "float" } convert => { "metric_mean" => "float" } convert => { "metric_stddev" => "float" } convert => { "metric_median" => "float" } convert => { "metric_p75" => "float" } convert => { "metric_p95" => "float" } convert => { "metric_p98" => "float" } convert => { "metric_p99" => "float" } convert => { "metric_p999" => "float" } convert => { "metric_mean_rate" => "float" } convert => { "metric_m1" => "float" } convert => { "metric_m5" => "float" } convert => { "metric_m15" => "float" } } } mutate { add_field => { "instance_name" => "%{app_name}-%{host}:%{app_port}" } } } output { elasticsearch { hosts => ["jh-genesis-elasticsearch"] } stdout { codec => rubydebug } }