# A question setting up logstash with raspberry pi

**URL:** <https://discuss.elastic.co/t/a-question-setting-up-logstash-with-raspberry-pi/97830>\
**Category:** Logstash\
**Created:** [August 21, 2017, 10:40pm UTC](https://discuss.elastic.co/t/a-question-setting-up-logstash-with-raspberry-pi/97830 "2017-08-21T22:40:43Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![bm1391](https://avatars.discourse-cdn.com/v4/letter/b/65b543/32.png) [@bm1391](https://discuss.elastic.co/u/bm1391)\
**Post date:** [August 21, 2017, 10:40pm UTC](https://discuss.elastic.co/t/a-question-setting-up-logstash-with-raspberry-pi/97830/1 "2017-08-21T22:40:43Z")

</div>

Hi all,

I am setting up a raspberry pi 3 to send syslogs (rsyslog) to a server running logstash. I have installed filebeat on the raspberry pi in order to ship the logs to the logstash server. For some reason, the logstash server is not seeing these logs. The Raspberry pi is running debian stretch 9.1.

I installed the raspberry pi binary via [https://beats-nightlies.s3.amazonaws.com/jenkins/filebeat/](https://beats-nightlies.s3.amazonaws.com/jenkins/filebeat/) and created some systemd files  
On raspberry pi, here is filebeat config: The Cert was created on the logstash server(10.100.1.7:5044)

```
filebeat:
  prospectors:
    -
      paths:
        - /var/log/auth.log
        - /var/log/syslog
      # - /var/log/*.log

      input_type: log

      document_type: syslog

  registry_file: /var/lib/filebeat/registry

output:
  logstash:
    hosts: ["10.100.1.7:5044"]
    bulk_max_size: 1024

    tls:
      certificate_authorities: ["/etc/ssl/logstash-forwarder.crt"]

shipper:

logging:
  files:
    rotateeverybytes: 10485760 # = 10MB

```

Here is config files on logstash server:

02-beats-input.conf

```
input {
 beats {
   port => 5044
   host => "0.0.0.0"
   ssl => true
   ssl_certificate => "/etc/ssl/logstash-forwarder.crt"
   ssl_key => "/etc/ssl/logstash-forwarder.key"
   congestion_threshold => "40"
  }
}

```

10-syslog-filter.conf

```
filter {
  if [type] == "syslog" {
grok {
  match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" }
  add_field => ["received_at", "%{@timestamp}"]
  add_field => ["received_from", "%{host}"]
}
syslog_pri { }
date {
  match => ["syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"]
}
  }
}

```

And the other config file: The host ip below is the Elastic search running on another server(10.100.1.16)  
30-elasticsearch-output.conf

```
output {
  elasticsearch {
    hosts => ["10.100.1.16:9200"]
    sniffing => true
    manage_template => false
    index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
    document_type => "%{[@metadata][type]}"
  }
}

```

`sudo /opt/logstash/bin/logstash --configtest -f /etc/logstash/conf.d/`

returns OK

Any help would be appreciated!

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 23, 2017, 8:51pm UTC](https://discuss.elastic.co/t/a-question-setting-up-logstash-with-raspberry-pi/97830/2 "2017-08-23T20:51:42Z")

</div>

Look in the logs of both Filebeat and Logstash. Check the network connectivity from the RaspberryPi to the Logstash box.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 20, 2017, 8:52pm UTC](https://discuss.elastic.co/t/a-question-setting-up-logstash-with-raspberry-pi/97830/3 "2017-09-20T20:52:42Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.