Filebeat multiple modules on single input syslog port

Elastic Stack Beats
1

Hi All,

I have installed filebeat Syslog input and received logs from multiple devices like Vmware Esx, Firewall, Unix, VCenter, Antivirus, etc.

Filebeat Yml file:
fields_under_root: true
fields.collector_node_id: ${sidecar.nodeName}
fields.gl2_source_collector: ${sidecar.nodeId}

output.logstash:
hosts: ["XXX.XXX.XX.XX:XXX"]
path:
data: ${sidecar.spoolDir!"C:\Program Files\Graylog\sidecar\cache\filebeat"}\data
logs: ${sidecar.spoolDir!"C:\Program Files\Graylog\sidecar"}\logs

filebeat.inputs:

  • type: syslog
    enabled: true
    keep_null: true
    format: auto
    timeout: 10
    protocol.udp:
    host: "0.0.0.0:514"

  • type: syslog
    enabled: true
    format: auto
    timeout: 10
    keep_null: true
    protocol.tcp:
    host: "0.0.0.0:514"

I want to use modules to parse all the logs using filebeat. Please let me know how to achieve this.

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.