Logstash forwarder settings

Elastic Stack Logstash
1

Dear all,

I have a lot of application logs on different hosts.

I am going transfer all my application logs into time based index.

So, i have couple of questions:

1.How and where i can mark transferring logs that they belong to some application?

For example, logs of "A application", "B application", etc.

2.Should me to insert logs in time based index in the same type giving some settings in logstash forwarder or not?

3.Where can i get all possible settings for logstash forwarder and logstash indexer?

Thank you in advance

2

How and where i can mark transferring logs that they belong to some application?

The type field is often used for this, but you can define other fields too.

Should me to insert logs in time based index in the same type giving some settings in logstash forwarder or not?

Sorry, I can't parse this sentence.

Where can i get all possible settings for logstash forwarder and logstash indexer?

Have you looked at the documentation at elastic.co?

3

Thanks a lot Magnus.

Should me config it in logstash forwarder or in logstash indexer?

I mean should me insert logs which belong to different applications to the same "table"-type or not by means some settings in logstash forwarder

4

Should me config it in logstash forwarder or in logstash indexer?

Do that as close to the source as possible, i.e. in the forwarder instance of Logstash that collects the data.

5

Thank you very much for quick response, Magnus.

Time based index also should be configured in logstash forwarders which are collects data?

6

That's typically done in the indexer instance.

7

Dear Magnus,

Could you please provide one examples of logstash-forwarder config and one example of logstash-indexer config for my case?

Imagine that i have two tomcats on the same host and two applications working on them (A and B).

The goal is place logs of applications to time based index in elasticsearch and having properties reffered to applications generated these logs.

It will be greatly appreciated and it will be solution of this topic for me.

Thank you in advance.

8

Magnus, could you please help me?

9

I'm afraid I don't have time to write up such detailed examples.

10

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.