logstash.conf

input {
     file {
         type => "wd"
         path => ["/usr/sap/webdispatcher/access*"]
         start_position => "beginning"
         codec => plain {
                charset => "ISO-8859-1"
         }
     }
}

filter {
  if [type] == "wd" {
    grok {
      patterns_dir => "./patterns"
      match => { "message" => "%{WEBDISPATCHER}" }
    }
    date {
      match => ["timestamp", "dd/MMM/yyyy:HH:mm:ss Z" ]
    }
    mutate {
        convert => [ "bytes", "integer" ]
        convert => [ "duration", "integer" ]
    }
    metrics {
      meter => "events"
      add_tag => "metric"
    }
  }
}

output {
     elasticsearch {
        host => localhost
        index => "wd"
        index_type => "logs"
        protocol => "http"
     }

     if "metric" in [tags] {
        stdout {
               codec => line {
                    format => "Rate: %{events.rate_1m} and count %{events.count}"
               }
          }
     }
}