Hi!
I'm new to ELK.... configured a Elasticsearch and Kibana, but my logstash doesn't work.... I'm get this message from client
Exiting: Template loading requested but the Elasticsearch output is not configured/enabled
My logstash/conf.d:
- 02-beats-input.conf
input {
beats {
port => 5443
type => syslog
ssl => false
}
}
- 10-syslog-filter.conf
filter {
if [type] == "syslog" {
grok {
match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" }
add_field => [ "received_at", "%{@timestamp}" ]
add_field => [ "received_from", "%{host}" ]
}
syslog_pri { }
date {
match => [ "syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss" ]
}
}
}
- 30-elasticsearch-output.conf
output {
elasticsearch {
hosts => ["10.132.13.40:9200"]
manage_template => false
index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
document_type => "%{[@metadata][type]}"
}
stdout {}
}