Importing teamviewer logs getting started

Elastic Stack Logstash
1

Just need a little direction just got everything installed and trying to read through the documentation. I want to import teamviewer logs into logstash and then get it to kibana. They way I understand it is filebeat is just what sends the fileover to logstash if its a remote server. So if it's located locally I can just input the file directly into logstash "Which i what I am attempting now". So In logstash would I use the logstash-simple.conf or logstash.json file? Once that's configured how would I find these logs in kibana?

Here's what I have added to the logstash-simple.conf

input { stdin { } 
  file {
    path => "C:/Program Files (x86)/TeamViewer/TeamViewer11_Logfile.log"
    type => "teamviewer"  # a type to identify those logs (will need this later)
    start_position => "beginning"
}
output {
  elasticsearch { hosts => ["localhost:9200"] }
  stdout { codec => rubydebug }
}

Operating System Windows Server 2012 R2
ELK Version 6.5.4

2

Or it can send directly to Elasticsearch.

Use the .conf files. (Not sure where you got the json one from?)

3

I was following this tutorial

THIRD STEP : Installing Logstash.

  1. Before installing Logstash, you will need to create a “logstash.json” configuration file in the bin folder inside an unzipped Logstash folder. (in my case: C:\ELK\logstash\bin)
4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.