f2b.conf

input {
  file {
    start_position => "beginning"
    path => [ "/var/log/fail2ban.log" ]
  }
}

filter {
  if [type] == "fail2ban" {
    grok {
      patterns_dir => "/etc/logstash/patterns"
      match => [
        "message", "%{F2B_DATE:date} %{F2B_ACTION} %{WORD:level} %{F2B_JAIL} %{WORD:action} %{IP:ip}",
        "message", "%{F2B_DATE:date} %{F2B_ACTION} %{F2B_LEVEL} %{GREEDYDATA:msg}?"
      ]
    }

  }
}

output {
	stdout{
		codec => rubydebug 
	}

}