VictoriaMetrics/deployment/docker/victorialogs/logstash/elasticsearch/pipeline.conf

input {
  syslog {
    port => 5140
  }
}

output {
  opensearch {
    hosts => ["http://victorialogs:9428/insert/elasticsearch"]
    custom_headers => {
        "AccountID" => "0"
        "ProjectID" => "0"
    }
    parameters => {
        "_stream_fields" => "host.ip,process.name"
        "_msg_field" => "message"
        "_time_field" => "@timestamp"
    }
  }
}