How to configure "Logstash" syslog

Elastic Stack Logstash
1

I have a question. I started using docker-elk but ı have a problem because Logstash syslog is not working.Actually the default conf file was working.

This using : https://github.com/deviantony/docker-elk

But I was working this way;

nc localhost 5000 </var/log/syslog

But now I want to work on the logstash.conf file but I can't do it

default logstash.conf

input {
  tcp {
    port => 5000
  }
}

## Add your filters / logstash plugins configuration here

output {
  elasticsearch {
    hosts => "elasticsearch:9200"
  }
}

logstash.conf

input {
  file {
    path => "/var/log/syslog"
    start_position => "beginning"
    sincedb_path => "/dev/null"
  }
}

output {
 elasticsearch {
   hosts => ["elasticsearch:9200"]
 }
 stdout { codec => rubydebug }
}

Why does this conf file not work? How do I run it?

thanks in advance

2

So... it's the second configuration file that isn't working?

3

Yes.

4

Does the Logstash process running inside the Docker container have access to the host's /var/log/syslog file? Unless you're mounting e.g. /var/log from the host into the container Logstash will attempt to read /var/log/syslog from the container's file system, which most likely isn't what you want.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.