sfdc_elf.config

input {  
    sfdc_elf {
        # === Required Fields ===
        
        # Input the username and password of your Force.com organization.
        username       => ""
        password       => ""

        # Id & Secret are values that are generated when you create a "Connected App."
        client_id      => ""
        client_secret  => ""

        
        # === OPTIONAL FIELDS ===
        # Leave these fields commented out (with '#') if the config does not apply to you. Some of the fields 
        # have default values
        
        # Only needed when your Force.com organization requires it.
        # security_token => ""

        # The path to be use to store the .sfdc_info_logstash state persistor file. You set the path
        # like so, "~/SomeDirectory" Paths must be absolute and cannot be relative.
        # Defaults to your home directory "~/".
        # path           => ""

        # Specify how often the plugin should grab new data in terms of minutes.
        # Defaults to 1440 minutes (1 day). We recommend keeping it at 1 day.
        # poll_interval_in_minutes => 60
        
        # The host to use for OAuth2 authentication. 
        # Defaluts to "login.salesforce.com".
        # Use "test.salesforce.com" for connecting to Sandbox instance.
        # host           => ""

    }
}

# After the data has been parsed, if it containts a field called "CLIENT_IP" or "SOURCE_IP" then  
# convert those IP addresses to a GeoIP. By doing this you can plot data on to a map in kibana.
# Note GeoIP is a Logstash plugin.
filter {  
    geoip {
        source => "CLIENT_IP"
        target => "geoip"
    }
    geoip {
        source => "SOURCE_IP"
        target => "source_ip"
    }
}

# After data has been filtered, push it to elasticsearch via "http" to "0.0.0.0:9200"
# Also tell elasticsearch to index the data based on the field called "type."
output { 
    elasticsearch {
      protocol => "http"
      host => ["0.0.0.0:9200"]
    } 
}