input { file { path => '/data/rsyslog/*/*/*.log' start_position => 'beginning' sincedb_path => '/data/rsyslog/sincedb/.db' } } filter { grok { match => { path => "%{GREEDYDATA}/%{GREEDYDATA:type}\.log" } } mutate { gsub => [ "type", "-web[0-9]+", "" ] } } output { redis { host => '127.0.0.1' db => '0' key => 'logs' data_type => 'list' } }