elasticsearch/logstash — pull request #1515 by nealpatel-work (2014-07-09 21:37:51+00:00)
Title: inputs/archive.rb: added a new input for archived files

Currently, it is not very easy to add compressed logs to logstash. You have
to decompress your archive and then use a file input. It gets worse when you
have multiple archives, or if more archives are constantly being created.
This is a huge problem for us when it comes to webserver logs, because we
want to ingest existing gzipped-logs as well as any new gzipped-logs that
might be created.

The code I am contributing allows you to process gzipped (archived) logs.
At this time, this input only supports gzipped (*.gz) archives, although I
suppose you could always add in support for other compression algos. It is
basically a ripoff of the `file` input (with a few changes).