logstash

input {
    beats {
        port => "5044"
    }
}

filter {
     dissect {
         mapping => { "message" => "%{tmp}|%{+tmp}|%{+tmp}|%{+tmp}|%{uuid}|%{+tmp}|%{imei}|%{+tmp}|%{+tmp}|%{+tmp}"}
         remove_field => ["tmp", "@timestamp", "@version", "source", "offset", "log", "message", "prospector", "input", "beat", "host", "tags"]
     }
}

output {
    elasticsearch {
        hosts => ["10.35.154.13:9200", "10.35.154.28:9201", "10.35.132.19:9200", "10.35.154.13:9201", "10.35.154.28:9200", "10.35.132.19:9201"]
        index => "user"
        document_type => "user"
        document_id => "%{id}"
    } 
}