input { stdin { codec => json_lines { charset => "UTF-8" } } } filter { date { # Parse Eliot timestamp filed into the special @timestamp field Logstash # expects: match => [ "timestamp", "UNIX" ] target => ["@timestamp"] } } output { # Stdout output for debugging: stdout { codec => rubydebug } elasticsearch { # We make the document id unique (for a specific index/mapping type pair) by # using the relevant Eliot fields. This means replaying messages will not # result in duplicates, as long as the replayed messages end up in the same # index. document_id => "%{task_uuid}_%{task_level}" } }