Hi everyone!
I'm new to ELK stack and have encountered a problem I can't seem to figure out...
I currently have three machines in my ELK environment :
- syslog server (Logstash, ElasticSearch, Kibana)
- WAPT server (sofware deployment) => filebeat version 1.3.1 (amd64)
- GLPI server => filebeat version 6.1.1 (amd64), libbeat 6.1.1
WAPT server to Logstash works fine, but GLPI to Logstash doesn't...
"Failed to publish events caused by: read tcp glpi_ip:39200->syslog_ip:5044: read: connection reset by peer
2018-01-08T10:12:02+01:00 INFO retryer: send wait signal to consumer
2018-01-08T10:12:02+01:00 INFO done
2018-01-08T10:12:02+01:00 ERR Failed to publish events caused by: client is not connected"
Both clients use the same Filbeat.yml file:
filebeat:
prospectors:
-
paths:
- /var/log/syslog
- /var/log/auth.log
input_type: log
document_type: syslog
registry_file: /var/lib/filebeat/registry
output:
logstash:
hosts: ["172.16.1.183:5044"]
bulk_max_size: 1024
tls:
certificate_authorities: ["/etc/pki/tls/certs/logstash-forwarder.crt"]
shipper:
logging:
files:
rotateeverybytes: 10485760 # = 10MB
And here is the Logstash configuration:
input {
beats {
port => 5044
ssl => true
ssl_certificate => "/etc/pki/tls/certs/logstash-forwarder.crt"
ssl_key => "/etc/pki/tls/private/logstash-forwarder.key"
# Ferme la connexion inactive au bout d'1 minute au lieu de 15 secondes
#client_inactivity_timeout => 60
}
}
filter {
if [type] == "syslog" {
grok {
match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" }
add_field => [ "received_at", "%{@timestamp}" ]
add_field => [ "received_from", "%{host}" ]
}
syslog_pri { }
date {
match => [ "syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss" ]
}
}
}
output {
elasticsearch {
hosts => ["localhost:9200"]
sniffing => true
manage_template => false
index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
document_type => "%{[@metadata][type]}"
}
}
ELK stack versions:
logstash:
Installé : 1:6.1.1-1
Candidat : 1:6.1.1-1
Table de version :
*** 1:6.1.1-1 500
elasticsearch:
Installé : 6.1.1
Candidat : 6.1.1
Table de version :
*** 6.1.1 500
kibana:
Installé : 6.1.1
Candidat : 6.1.1
Table de version :
*** 6.1.1 500