input {
file {
type => "message"
path => [ "/var/log/messages" ]
start_position => "end"
stat_interval => 1
discover_interval => 3
}
}

filter {
if [type] == "message" {
grok {
match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{DATA:syslog_program}(?:\[{POSINT:syslog_pid}\])?:\s+%{GREEDYDATA:syslog_message}" }
}
date {
match => [ "syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss" ]
}
}
}

output {
stdout {}
}

log_format json_combined escape=json
  '{'
    '"time_local":"$time_local",'
    '"remote_addr":"$remote_addr",'
    '"remote_user":"$remote_user",'
    '"request":"$request",'
    '"status": "$status",'
    '"body_bytes_sent":"$body_bytes_sent",'
    '"request_time":"$request_time",'
    '"http_referrer":"$http_referer",'
    '"http_user_agent":"$http_user_agent"'
  '}';
access_log /var/log/nginx/access.log json_combined;

input {
  file {
    type => "nginx" 
    path => [ "/var/log/nginx/access.log" ]
    start_position => "end" 
  }
}

filter {
  if [type] == "nginx" {
    json {
      source => "message" 
    }
  }
}

output {
  stdout {}
}

log_format json_combined escape=json
  '{'
    '"time_local":"$time_local",'
    '"remote_addr":"$remote_addr",'
    '"remote_user":"$remote_user",'
    '"request":"$request",'
    '"status": "$status",'
    '"body_bytes_sent":"$body_bytes_sent",'
    '"request_time":"$request_time",'
    '"http_referrer":"$http_referer",'
    '"http_user_agent":"$http_user_agent"'
  '}';
access_log syslog:server=unix:/dev/log,tag=nginx,severity=error,nohostname json_combined;

input {
file {
type => "syslog"
path => [ "/var/log/syslog" ]
start_position => "end"
}
}

filter {
if [type] == "syslog" {
grok {
match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{DATA:syslog_program}(?:\[{POSINT:syslog_pid}\])?:\s+%{GREEDYDATA:syslog_message}" }
}
json {
source => "[syslog_message]"
target => "[nginx_message]"
}
}
}

output {
stdout {}
}