input { file { path => "/home/nginx.log" start_position => "beginning" sincedb_path => "/dev/null" } } filter { json { source => "message" } geoip { source => "remote_ip" } useragent { source => "agent" target => "useragent" } } output { elasticsearch { hosts => ["http://es:9200"] index => "nginx" } stdout { codec => rubydebug } }