title: Send Java errors from Filebeat to Logstash
body: <p>Please help me change configuration in <code>filebeat</code> and <code>Logstash</code> to send Java errors, info etc.
  My currently working system can send system logs.</p>
  
  <p>filebeat.yml :</p>
  
  <pre><code>filebeat:
    prospectors:
      -
        paths:
         # - /var/log/auth.log #if uncomment, filebeat will send auth logs
  
           - server.log
  
        input_type: log
  
        document_type: syslog
  
    registry_file: /var/lib/filebeat/registry
  
  output:
    logstash:
      hosts: ["10.13.34.96:5044"]
      bulk_max_size: 1024
  
      tls:
        certificate_authorities: ["/etc/pki/tls/certs/logstash-forwarder.crt"]
  
  shipper:
  
  logging:
    files:
      rotateeverybytes: 10485760 # = 10MB
  </code></pre>
  
  <p>Logstash 02-beats-input.conf:</p>
  
  <pre><code>input {
      beats {
          port =&gt; 5044
          ssl =&gt; true
          ssl_certificate =&gt; "/etc/pki/tls/certs/logstash-forwarder.crt"
          ssl_key =&gt; "/etc/pki/tls/private/logstash-forwarder.key"
      }
  }
  </code></pre>
  
  <p>10-syslog-filter.conf:</p>
  
  <pre><code>filter {
      if [type] == "syslog" {
          grok {
              match =&gt; { "message" =&gt; "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" }
              add_field =&gt; [ "received_at", "%{@timestamp}" ]
              add_field =&gt; [ "received_from", "%{host}" ]
          }
          syslog_pri { }
          date {
              match =&gt; [ "syslog_timestamp", "MMM  d HH:mm:ss", "MMM dd HH:mm:ss" ]
          }
      }
  }
  </code></pre>
  
  <p>30-elasticsearch-output.conf:</p>
  
  <pre><code>output {
      elasticsearch {
          hosts =&gt; ["localhost:9200"]
          sniffing =&gt; true
          manage_template =&gt; false
          index =&gt; "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
          document_type =&gt; "%{[@metadata][type]}"
      }
  }
  </code></pre>
  
  <p>In this case filebeat did not send information because
  document_type: syslog
  What I have to change in my configurations.</p>