heka的一个简单配置：
[hekad]
maxprocs= 48
[TcpInput]
address= ":514"
parser_type= "token"
decoder= "shipped-nginx-decoder"
[shipped-nginx-decoder]
type= "MultiDecoder"
subs= ['RsyslogDecoder', 'nginx-access-decoder']
cascade_strategy= "all"
log_sub_errors= true
[RsyslogDecoder]
type= "SandboxDecoder"
filename= "lua_decoders/rsyslog.lua"
[RsyslogDecoder.config]
type = "nginx.access"
template = '<%pri%>%TIMESTAMP% %HOSTNAME% %syslogtag%%msg:::sp-if-no-1st-sp%%msg:::drop-last-lf%\n'
tz = "Asia/Shanghai"
[nginx-access-decoder]
type= "SandboxDecoder"
filename= "lua_decoders/nginx_access.lua"
[nginx-access-decoder.config]
type = "combined"
user_agent_transform = true
log_format = '[$time_local]`$http_x_up_calling_line_id`"$request"`"$http_user_agent"`$staTus`[$remote_addr]`$http_x_log_uid`"$http_referer"`$request_time`$body_bytes_sent`$http_x_forwarded_proto`$http_x_forwarded_for`$request_uid`$http_host`$http_cookie`$upstream_response_time'
[ESLogstashV0Encoder]
es_index_from_timestamp= true
fields= ["Timestamp", "Payload", "Hostname", "Fields"]
type_name= "%{Type}"
[ElasticSearchOutput]
message_matcher= "Type == 'nginx.access'"
server= "http://eshost.example.com:9200"
encoder= "ESLogstashV0Encoder"
flush_interval= 50
flush_count= 5000
