Winlogbeat sending logs from several windows servers to ELK
When I try to index logstash (rsyslog), I dont see any data.
here is the input:
input {
beats {
port => 5044
}
udp {
host => "192.168.232.215"
port => 10514
codec => "json"
type => "rsyslog"
}
}
Here is the output:
output {
elasticsearch {
hosts => ["localhost:9200"]
sniffing => true
manage_template => false
index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
document_type => "%{[@metadata][type]}"
}
if [type] == "rsyslog" {
elasticsearch {
hosts => [ "localhost:9200" ]
}
}
}
I can see winlogbeat data in kibana UNTIL I add the UDP section to the inputs and add the IF [TYPE]==rsyslog to the outputs.
The rsyslog stuff is shipped to the ELK which runs rsyslog. I have verified that the ASA Firewall logs are getting to the ELK stack. If I look at indices I see:
[root@brt1-log01 rsyslog.d]# curl -XGET http://localhost:9200/_cat/indices
yellow open winlogbeat-2017.01.17 5 1 111149 0 136.9mb 136.9mb
yellow open winlogbeat-2017.01.18 5 1 341404 0 386.2mb 386.2mb
yellow open .kibana 1 1 104 1 104.7kb 104.7kb
yellow open %{[@metadata][beat]}-2017.01.18 5 1 19877 0 3.9mb 3.9mb
yellow open logstash-2017.01.18 5 1 0 0 737b 737b
The last entry is the rsyslog stuff, I assume. That last 2 numbers are incrementing.
MIke,
Your input config doesn't need the host line, that is to define what IP that Logstash is listening on. If you have multiple NICs, then you might need it, but I doubt it.
To see if the syslog messages are really arriving, do a:
tcpdump -n -A src x.x.x.x
That will show the ASCII text of the syslog messages.
So, it appears that the UDP pipeline on 10514 never starts. How can figure out why? netstat shows that as:
netstat -na | grep 10514
udp 0 0 192.168.232.215:10514 0.0.0.0:*
Does the above info get anyone closer to figuring out why this is not working?
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.