Configure Logstash to accept data from one host location to another host location

[Mani2451 (Mani)]

Hi,
i am trying to configure logstash by accepting data from one host location i.e xyz1.com to xyz2.com and the xyz 1 has a log which needs to be sent to xyz2 and then it should be parsed . Since i'm able to see that input file only takes the log files which are located inside the same host .

Just an example to show that /var/log/apache/access.log is located in xyz2.com and this is the only solution which i got as of now and i want /var/log/message.log from xyz1.com location to be sent to xyz2 location and get parsed !

reference for xyz2:
input {
file {
path => "/var/log/apache/access.log"
type => "apache-access"
}
}

So , can you please help me in specifying the path which i should give in xyz2 host location in order to access the xyz1 host log file ?

[jkuang (Jimmy Kuang)]

I would recommend using Filebeat to ship the file over from xyz2.com to where your Logstash is (xyz1).

Here are some instructions that I find helpful in getting this setup.

https://www.elastic.co/guide/en/beats/filebeat/current/config-filebeat-logstash.html

or

http://www.tecmint.com/install-elasticsearch-logstash-and-kibana-elk-stack-on-centos-rhel-7/

Some Linux commands will be different if you're not using Centos 7.

[magnusbaeck (Magnus Bäck)]

So , can you please help me in specifying the path which i should give in xyz2 host location in order to access the xyz1 host log file ?

The already suggested solution of using Filebeat to ship the files is good. Logstash's file input (and Filebeat) can only read files in mounted file systems. Theoretically you could mount another host's log files via e.g. NFS, but that's not recommended.