Below is Logstash configuration:
input {
lumberjack {
host => "10.10.10.10"
port => 5230
ssl_certificate => '/ssl/logstash-forwarder.crt'
ssl_key => '/ssl/logstash-forwarder.key'
}
tcp {
port => 5514
type => "CDN"
ssl_cert => "/ssl/logstash-forwarder.crt"
ssl_key => "/ssl/logstash-forwarder.key"
ssl_enable => true
codec => line {
charset => "ISO-8859-1"
}
}
}
filter {
Grok filters for Postfix, CDN, Nginx and application logs
General structure is:
if [type] == “<SOME_TYPE>” {
process message with grok and other filter types.
}
}
output {
if [@metadata][type] in [ "postfix", "CDN"] {
elasticsearch {
host => [ "10.10.0.20" ]
protocol => "transport"
port => "9300"
cluster => "elasticsearch"
index => "%{[@metadata][type]}-%{+YYYY.MM.dd}"
document_type => "%{[@metadata][type]}"
manage_template => false
}
}
# 3 more elasticsearch outputs to handle the rest of the event types.
else {
file {
path => "/var/log/logstash/unknown_messages.log"
}
}
}