Continue working on Galah

docker/elk/logstash/dist/logstash.conf

@@ -99,6 +99,13 @@ input {
     type => "Endlessh"
   }
 
+# Galah
+  file {
+    path => ["/data/galah/log/galah.json"]
+    codec => json
+    type => "Galah"
+  }
+
 # Glutton
   file {
     path => ["/data/glutton/log/glutton.log"]
@@ -460,6 +467,13 @@ filter {
     }
   }
 
+# Galah
+  if [type] == "Galah" {
+    date {
+      match => [ "timestamp", "ISO8601" ]
+    }
+  }
+
 # Glutton
   if [type] == "Glutton" {
     date {