OpenAppID Stats

[Noebas]

I'm trying to get the openapp id stats to elk.

Using the u2openappid command to get the data into a logfile. This Logfile can then be send to logstash using syslog-ng.
The problem i'am facing is that the file has a different name (timestamp) every time. hoping to use a cronjob running someting like this:

u2openappid /var/log/snort/snort_em02035/app-stats.log.* > /var/syslog-ng/openappid.log

And then use syslog-ng to tail the file:

{
syslog(transport(udp) port(5150) ip(127.0.0.1));
file(“/var/syslog-ng/openappid.log” program_override(“OpenAppID”) flags(no-parse) follow_freq(1) );
};

Anybody been trying the same?
The result should be easy to parse using logstash so the problem is more getting it there.

Grok:
statTime="1428925680",appName="amazon",txBytes="45553",rxBytes="52296"
statTime="%{WORD:timestamp}",appName="%{WORD:appName}",txBytes="%{INT:app_txBytes}",rxBytes="%{INT:app_rxBytes}"