input {
    stdin {
        codec => json {

        }
    }
}
filter {
    tld {
        source => "name"
    }
    date {
        locale => "zh-CN"
        timezone => "Asia/Shanghai"
        match => ["timestamp","UNIX"]
        target => "timestamp"
    }
    mutate {
        add_field => {
            "[@metadata][index]" => "%{[tld][tld]}"
            "domain" => "%{[tld][domain]}"
        }
        remove_field => ["event","@timestamp","host","@version","tld"]
    }
}
output {
    elasticsearch {
        document_id => "%{name}"
        hosts => ["http://localhost"]
        user => "elastic"
        password => "0nlJjU=ZSUI6-f5qDcWT"
        index => "rapid7_fdns_%{[@metadata][index]}"
        template => "/home/bitnami/rapid7_fdns.json"
        template_overwrite => "true"
    }
}