Receive Splunk "uncooked" log fwds over 2026, send to Splunk server (x.x.x.153) over UDP port 5014
input {
udp{
port => 2026
}
tcp{
port => 2026
}
}
output {
udp {
host => ["x.x.x.153"]
port => "5014"
}
}
Soooo....Both Elastic and Splunk are getting the same logs....if I delete the "Beats" pipeline and restart Logstash, Splunk just gets the "uncooked" log data coming in over 2026 and Elastic gets nothing (makes sense).
What is a mystery is why is Logstash is ignoring the "Beats" Pipeline directive (only logs coming in over 5044) and sending "Beats" logs over to Splunk as well?
Unless specifically configured otherwise Logstash has a single event pipeline. All files in the conf.d directory are concatenated. All events from all inputs get passed to all filters and all outputs. If that's not desirable you need to add conditionals to route events the way you want.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.