linux/files/logstash-forwarder.conf

{
  "paths": [
    "/var/log/syslog",
    "/var/log/auth.log"
   ],
  "fields": { "type": "syslog" }
}