Logstash and/or Kibana config wrong

Elastic Stack Logstash
1

Hi,

I cannot understand why I create two indexes on logstash to grab syslogs from two devices and then send to EL.

input {
  udp {
    host => "192.168.0.73"
    port => "5515"
  }


}


filter {}

output {
        elasticsearch {
                hosts           => ["http://127.0.0.1:9200"]
                index           => "vngaf-test-eu-%{+YYYY.MM.dd}"
        }
}


input {
  tcp {
    host => "192.168.0.73"
    port => "5514"
  }


}


filter {}

output {
        elasticsearch {
                hosts           => ["http://127.0.0.1:9200"]
                index           => "logstash-test-%{+YYYY.MM.dd}"
        }
}

Than on Kibana WEB UI -> Stack Management -> Kibana Index Pattern , I create an index pattern called like in the indexes of the files.
So, I think that the device that send logs on port tcp 5514 writes on the index "logstash-test-" and the device that send logs on udp 5515 writes on "vngaf-test-eu".

Instead, all two devices write on all two indexes.
Could I know why?
What I wrong in the configuration?

Thanks

2

Because logstash Concatenates all the .conf files in a single directory... This is a very common mistake and misunderstanding.

So every event is going to both those outputs.

You need to use the pipelines.yml and name each of those pipelines separately.

3

Hello and thanks for your answer

I added these lines in the pipelines.yml but the result not changed.

# Custom Pipelines

- pipeline.id: cisco-pipeline_1
  path.config: "/etc/logstash/conf.d/cisco.conf"

- pipeline.id: vngaf_pipeline_2
  path.config: ""/etc/logstash/conf.d/vngaf.cfg"

Where is wrong?

Thanks

4

Are the events being sent to both ports?

Put a tag on the input and see if you see it on every event

input {
  udp {
    host => "192.168.0.73"
    port => "5515"
    tag => "udp"
  }

Same for the other...

Also would help if you showed the outputs. What are you seeing in discover??

How starting Logstash?

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.