Cannot make logstash receive syslog 514 traffic.
ELK run successfully and listens to port 514:
# docker-compose ps
Name Command State Ports
----------------------------------------------------------------------------------------------------------------------------------------
logstash_elasticsearch_1 /docker-entrypoint.sh elas ... Up 0.0.0.0:9200->9200/tcp, 0.0.0.0:9300->9300/tcp
logstash_kibana_1 /docker-entrypoint.sh kibana Up 0.0.0.0:5601->5601/tcp
logstash_mylogstash_1 /docker-entrypoint.sh bash Up 0.0.0.0:5000->5000/tcp, 0.0.0.0:514->514/tcp, 0.0.0.0:8080->8080/tcp
I have tried both plugins syslog and tcp/udp listening on port 514:
1- Syslog plugin:
input {
syslog { }
}
filter {
}
output {
stdout {
codec => rubydebug
}
}
Result From inside logstash container ==> Logstash do not react to syslog traffic:
21:03:29.310 [[main]-pipeline-manager] INFO logstash.pipeline - Pipeline main started
21:03:29.344 [Ruby-0-Thread-12: /usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-syslog-3.4.1/lib/logstash/inputs/syslog.rb:109] INFO logstash.inputs.syslog - Starting syslog udp listener {:address=>"0.0.0.0:514"}
21:03:29.357 [Ruby-0-Thread-14: /usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-syslog-3.4.1/lib/logstash/inputs/syslog.rb:113] INFO logstash.inputs.syslog - Starting syslog tcp listener {:address=>"0.0.0.0:514"}
21:03:29.533 [Api Webserver] INFO logstash.agent - Successfully started Logstash API endpoint {:port=>9600}
2- TCP/UDP plugin:
input{
tcp {
port => 514
type => syslog
}
udp {
port => 514
type => syslog
}
}
filter {
}
output {
stdout {
codec => rubydebug
}
}
Result ==> From inside logstash container: looks like something missing?
16:27:55.840 [[main]<udp] WARN logstash.inputs.udp - UDP listener died {:exception=>#<NameError: uninitialized constant LogStash::Inputs::Udp::IPAddr>, :backtrace=>["org/jruby/RubyModule.java:2746:in `const_missing'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-udp-3.3.1/lib/logstash/inputs/udp.rb:87:in `udp_listener'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-udp-3.3.1/lib/logstash/inputs/udp.rb:57:in `run'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:470:in `inputworker'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:463:in `start_input'"]}
Any hint guys, I am stuck here!!