ncedc-earthquakes-logstash.conf

input {
  stdin {}
}
filter {
  csv {
    columns => ["timestamp","latitude","longitude","depth","mag","magType","nst","gap","dmin","rms","source","event_id"]
    convert => {"latitude" => "float"}
    convert => {"longitude" => "float"}
    convert => {"depth" => "float"}
    convert => {"mag" => "float"}
    convert => {"dmin" => "float"}
    convert => {"rms" => "float"}
    convert => {"gap" => "float"}
    convert => {"nst" => "integer"}
    convert => {"event_id" => "integer"}
  }
  mutate {
    add_field => ["location", "%{latitude}, %{longitude}"]
    add_field => ["type", "${EVENT:earthquake}"]
    remove_field => ["latitude", "longitude"]
  }
  date {
    match => ["timestamp", "yyyy/MM/dd HH:mm:ss.SS", "ISO8601"]
    remove_field => ["timestamp"]
    timezone => "GMT"
  }
}
output {
#  stdout { codec => rubydebug { metadata => true } }
  stdout { codec => dots }
  elasticsearch {
#    hosts => [""]    
#    user => "elastic"
#    password => "changeme"
    index => "ncedc-earthquakes"
    template => "ncedc-earthquakes-template.json"
    template_name => "ncedc-earthquakes"
    template_overwrite => true
  }
}