Add Multiple input plugins in Logstash

I need to add two different input plugins in logstash i.e. Filebeat and jdbc but only jdbc is working. I am not sure is this the right way i am adding both of them? Please let me know what to do in this kind of scenario:

input {
beats{
port=> "5044"
}
jdbc {
jdbc_driver_library => "C:\Program Files\Microsoft JDBC Driver 6.0 for SQL Server\sqljdbc_6.0\enu\jre8\sqljdbc42.jar"
jdbc_driver_class => "com.microsoft.sqlserver.jdbc.SQLServerDriver"
jdbc_connection_string => "jdbc:sqlserver://myserverName:PortName;user=IntegrationUser;password=AHCS@12345;database=QAEsbExceptionDb;"
jdbc_user => "myuser"
jdbc_password => "mypassword"
statement => "SELECT * FROM [Fault]"
type => "esblogs"
}
}

filter {
if [type] == "log"{
grok{
match =>{"message"=>"%{TIMESTAMP_ISO8601:logtime} -[0-9]{2}:[0-9]{2} [%{LOGLEVEL:LogLevel}"}
add_field => [ "Received_at", "%{@timestamp}" ]
remove_field => ["@version", "offset", "tags"]
}
date{
match => [ "logtime", "YYYY-MM-dd HH:mm:ss.SSS" ]
target => "@timestamp"
}
}
}

output {
elasticsearch{
hosts => "localhost:9200"
index => "%{type}"
document_type => "doc"
}
}

This looks okay. Are you sure Filebeat is successfully sending any events to Logstash? For debugging purposes I suggest you temporarily replace the elasticsearch output with a stdout { codec => rubydebug } output that just dumps all events to stdout.

You are right! Basically my filebeat wasn't in sync with logstash pipeline. Now both inputs are working fine.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.