# NFO UDP 5514 -> Logstash -> Elasticsearch pipeline. input { udp { port => 5514 codec => json } } filter { date { match => ["time","yyyy-MM-dd'T'HH:mm:ss.SSSZ"] timezone => "Etc/UTC" locale => "en" target => "@timestamp" } #to fix: object mapping for [host] tried to parse field [host] as object, but found a concrete value mutate{ remove_field => [ "host" ] } } output { elasticsearch { hosts => ["http://localhost:9200"] index => "nfo-logstash-%{+yyyy.MM.dd}" template => "/etc/logstash/conf.d/nfo_mapping.json" template_name => "nfo*" } }