How to send syslogs to logstash

I want to send syslog data to logstash.

I'm trying to do this with the beats Syslog Output Plugin.

filebeat config:

        - /var/log/messages
        - /var/log/audit/audit.log
      document_type: syslog
  type: syslog
    network: udp
    raddr: ["localhost:1234"]

logstash config:

input {
  tcp {
    port => "1234"
    type => syslog

Something must be wrong because filebeat wont start and I get these errors:
ERR Failed to publish events caused by: write tcp> write: connection reset by peer

You seem to have configured Filebeat to send to localhost:1234 via UDP yet the error message indicates it's localhost:9999 via TCP. Are you really running the configuration you think you are?

Ah sorry that's a typo, the error did say the same port

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.