- move stuff around

etc/examples/indexer.conf

@@ -0,0 +1,30 @@
+input {
+  amqp {
+    host => "127.0.0.1"
+    user => "guest"
+    pass => "guest"
+    exchange_type => "topic"
+    name => "testing"
+    type => "all"
+  }
+
+  tcp {
+    port => 1234
+    type => "linux-syslog"
+  }
+}
+
+filter {
+  grok {
+    type => "linux-syslog"
+    pattern => ["%{SYSLOG_SUDO}", "%{SYSLOG_KERNEL}", "%{SYSLOGLINE}"]
+    add_tag => "grok"
+    add_field => ["test_key", "the pid is %{pid}"]
+  }
+}
+
+output {
+  stdout {
+    debug => true
+  }
+}