logsearch/logsearch-boshrelease — pull request #12 by wdneto (2014-04-24 05:03:07+00:00)
Title: Switch to TCP/UDP inputs instead of syslog

The syslog input causes _grokparsfailures due to CF messages not matching the
standard linux-syslog message format. Because of the failure, CF rules do not
come into effect.

https://github.com/elasticsearch/logstash/blob/1.3.x/lib/logstash/inputs/syslog.rb#L55-L69
https://github.com/logsearch/logstash-filters-cf/blob/master/src/100-cloudfoundry.conf.erb#L8