logstash.conf

input { 
	file {
#		start_position => "beginning"
		path => ["/path/to/logs/access.log"]
		type => "cq-access"
	}
	file {
#		start_position => "beginning"
		path => ["/path/to/logs/request.log"]
		type => "cq-request"
	}
    file {
 #   	start_position => "beginning"
    	path => ["/path/to/logs/error.log"]
    	type => "cq-error"
    }
}

filter {
	if [type] == "cq-access" {
		grok { 
			match => [ "message", "%{IPORHOST:clientip} - %{USER:ident} %{HTTPDATE:timestamp} %{QS}" ]
		}
		date {
			match => [ "timestamp" , "dd/MMM/yyyy:HH:mm:ss Z" ]
		}
	} else if [type] == "cq-request" {
		grok {
			match => [ "message", "^%{HTTPDATE:timestamp} \[%{NUMBER:id}\]"]
		}
		multiline {
			pattern => "^%{HTTPDATE:timestamp} \[%{NUMBER:id}\] <-"
			negate => "true"
			what => "next"
			stream_identity => "%{id}"
		}
		date {
				match => [ "timestamp" , "dd/MMM/yyyy:HH:mm:ss Z" ]
		}
		mutate {
	    	gsub => [
	    		"message","\n"," ",
	    		"message","\r",""
    		]
	  	}
	  	grok {
				match => [ "message", "^%{HTTPDATE:timestamp} \[%{NUMBER:id}\] -> %{WORD:method} %{NOTSPACE:request} HTTP/%{NUMBER:httpversion} .* %{NUMBER:status} %{NOTSPACE:contentType} %{NUMBER:response:int}ms$"]
		}
	} 
	else if [type] == "cq-error" {
		multiline {
			pattern => "^%{DATESTAMP}"
			negate => "true"
			what => "previous"
		}
		grok {
			match => [ "message", "%{DATESTAMP:timestamp} \*%{NOTSPACE:severe}\*"]
		}
		date {
			match => [ "timestamp" , "dd.MM.yyyy HH:mm:ss.SSS" ]
		}
	}
}

output {
  elasticsearch { host => localhost }
#  stdout { codec => rubydebug }
}