I am trying to setup a rsyslog+ELK stack following this tutorial without success:
My configuration is similar to the one in the tutorial except that the rsyslog server and the whole ELK stack are running on the same server.
Note that the ELK stack was previously used with Filebeat and it was working fine.
The rsyslog server receive the logs from the client and generate the template as expected. It seems to also send the logs to logstash properly according to rsyslog debug logs:
"ACTION 0x1bc5a40 [builtin:omfwd:@localhost:10514;json-template]"
Full rsyslog server logs generated when "sudo ls" is executed on the rsyslog client are available here:
However, I can't find the logs in elasticsearch and I don't see anything happening in logstash logs, even though it is listening to the correct port:
$ sudo netstat -na | grep 10514
udp6 0 0 127.0.0.1:10514 :::*
Here are the versions of the softs I am using:
The configuration I use for rsyslog, logstash and elasticsearch can be found here:
Does anyone have an idea about how to find what is wrong ?