Logstash not getting any syslog

Elastic Stack Logstash
1

Hello
I have just installed ELK on my Linux Debian, and i can access kibana.
But i just seem to get No results found :(. I have config a fortigate firewall and juniper switch to syslog everything to the server.
But still i cant see anything. Is there any logs that i can check to see to find any information regarding this ?
In the /var/log/logstash.err is empty, logstash.log is showing :
{:timestamp=>"2015-12-21T13:41:32.792000+0100", :message=>"SIGTERM received. Shutting down the pipeline.", :level=>:warn}
{:timestamp=>"2015-12-21T14:21:33.948000+0100", :message=>"SIGTERM received. Shutting down the pipeline.", :level=>:warn}

cat logstash.stdout
Sending logstash logs to /var/log/logstash/logstash.log.

2

Edit
When running tcpdump -Xni eth0 port 514, I can see that i get syslog info
but kibana does not show anything.

3

Increasing Logstash's logging verbosity by starting it with --verbose or even --debug could result in useful clues in /var/log/logstash/logstash.log.

4

Hello
I cant seem to find where i can change the logging to debug. i would think that it be /etc/logstash/conf.d but my syslog.conf is only showing :
filter {
if [type] == "syslog" {
grok {
match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:[%{POSINT:syslog_pid}])?: %{GREEDYDATA:syslog_message}" }
add_field => [ "received_at", "%{@timestamp}" ]
add_field => [ "received_from", "%{host}" ]
}
syslog_pri { }
date {
match => [ "syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss" ]

Where can change the logging to be on debug?
Thank you

5

Logstash's startup options are typically set in /etc/default/logstash or /etc/sysconfig/logstash.

6

Hello
You where correct good sir, /etc/default. I found the logstash file
Iam correct to assume that i can add a level like "#level: debug" . Or is this incorrect ?

logstash logging

#LS_LOG_FILE=/var/log/logstash/logstash.log
#LS_USE_GC_LOGGING="true"

Thank You

7

No, uncomment and modify the LS_OPTS variable:

LS_OPTS="--debug"
8

Hello
I have edit the LS_OPTS to show #LS_OPTS="--debug" But even after restarting logstash as a services. i dont see anything in the logstash.err, logstash.log , logstash.stdout. I cant seem to find a sepreat debug log either.
Have i missed something ?

9

Remove the hash; LS_OPTS="--debug" not #LS_OPTS="--debug". Details matter!

10

So i got the debug running, but i cant seem to make sense of it. What do you think ? I have posted it to pastebin
http://pastebin.com/z6vPDihP

11

Does anyone know ?