log-ship-elastic-qpsmtpd.ini
[main]
spool=/var/spool/log_ship/qpsmtpd
;email=admin@example.com
[elastic]
module=elasticsearch
hosts=es1:9200, es2:9200, es3:9200
index=qpsmtpd-YYYY-MM-DD
indices=qpsmtpd-*
type=qpsmtpd
[parser]
module=json-parser
; syslog lines don't have time zone data. Do set this!
; timezone map: http://momentjs.com/timezone/
timezone=America/Phoenix
[reader]
module=safe-log-reader
file=/var/log/qpsmtpd/json.log
; after reaching the end of file, how many seconds after a log file has
; grown to resume reading
watchDelay=10
; how many lines to read in before pausing
batchLimit=7
; seconds to pause between batches.
batchDelay=1