Filebeat syslog input : enable both TCP + UDP on port 514

Elastic Stack Beats
1

Hello guys,
I can't enable BOTH protocols on port 514 with settings below in filebeat.yml
Does this input only support one protocol at a time? Nothing is written if I enable both protocols, I also tried with different ports. Filebeat directly connects to ES.

# Syslog input
filebeat.inputs:
- type: syslog
  enabled: true
  max_message_size: 10KiB
  keep_null: true
  timeout: 10
  protocol.udp:
    host: "myhost.net:514"

filebeat.inputs:
- type: syslog
  enabled: true
  max_message_size: 10KiB
  timeout: 10
  keep_null: true
  protocol.tcp:
    host: "myhost.net:514"

Log:
2020-04-18T20:39:12.200+0200 INFO [syslog] syslog/input.go:155 Starting Syslog input {"protocol": "tcp"}
nothing in log regarding udp.

Thanks for your help.

2

The problem might be that you have two filebeat.inputs: sections. How about something like the following instead?

# Syslog input
filebeat.inputs:
- type: syslog
  enabled: true
  max_message_size: 10KiB
  keep_null: true
  timeout: 10
  protocol.udp:
    host: "myhost.net:514"

- type: syslog
  enabled: true
  max_message_size: 10KiB
  timeout: 10
  keep_null: true
  protocol.tcp:
    host: "myhost.net:514"
3

It works, thanks :slight_smile:

2020-04-21T15:14:32.017+0200 INFO [syslog] syslog/input.go:155 Starting Syslog input {"protocol": "tcp"}
2020-04-21T15:14:32.018+0200 INFO [syslog] syslog/input.go:155 Starting Syslog input {"protocol": "udp"}