message: log-type as metadata, use openshift_project also for application-logs
diff: @@ -16,20 +16,25 @@ filter {
  if [message] =~ /^{.*}$/ {
  # message is JSON, this is an application log
  mutate {
  - add_field => { "log-type" => "application-logs" }
  + add_field => { "[@metadata][log-type]" => "application-logs" }
  }
  json {
  source => "message"
  }
  if ![type] {
  mutate {
  - add_field => { "type" => "noproject" }
  + add_field => { "openshift_project" => "noproject" }
  + }
  + } else {
  + mutate {
  + add_field => { "openshift_project" => "%{type}" }
  + remove_field => [ "type" ]
  }
  }
  } else {
  # Not JSON, therefore a syslog and a router log entry
  mutate {
  - add_field => { "log-type" => "router-logs" }
  + add_field => { "[@metadata][log-type]" => "router-logs" }
  }
  grok {
  match => ["message", "(?:%{SYSLOGTIMESTAMP:syslog_timestamp}|%{TIMESTAMP_ISO8601:timestamp8601}) %{SYSLOGPROG}: %{HAPROXYHTTPBASE}"]
  @@ -68,8 +73,8 @@ filter {
  }
  output {
  - # stdout { codec => rubydebug }
  - if [log-type] == "router-logs" {
  + stdout { codec => rubydebug }
  + if [@metadata][log-type] == "router-logs" {
  elasticsearch {
  user => admin
  password => "${LOGSDB_ADMIN_PASSWORD}"
  @@ -84,7 +89,7 @@ output {
  user => admin
  password => "${LOGSDB_ADMIN_PASSWORD}"
  hosts => ["${ELASTICSEARCH_URL}"]
  - index => "application-logs-%{[type]}-%{+YYYY.MM}"
  + index => "application-logs-%{[openshift_project]}-%{+YYYY.MM}"
  template => "/usr/share/logstash/templates/application-logs.json"
  template_name => "application-logs"
  template_overwrite => true
  