feat: basic test in container

pipe/base.yml

@@ -0,0 +1,16 @@
+filter {
+    if [type] == "syslog" {
+        grok {
+            match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" }
+            remove_field => ["message"]
+        }
+        date {
+            match => [ "syslog_timestamp", "MMM  d HH:mm:ss", "MMM dd HH:mm:ss" ]
+            target => "@timestamp"
+            remove_field => ["syslog_timestamp"]
+        }
+        mutate {
+            remove_field => ["host"]
+        }
+    }
+}