input { file { type => "syslog" path => [ "/var/log/maillog", "/var/log/messages", "/var/log/secure" ] start_position => "beginning" } } output { stdout { codec => rubydebug } elasticsearch { hosts => ["127.0.0.1:9200"] } }