Logstash with multiple inputs and outputs

Elastic Stack Logstash
1

HI All,
I am trying to send rsyslog and gelf msgs from logstash to Graylog server
I am getting the below error
:reason=>"Expected one of #, { at line 18, column 12 (byte 207) after output {\n if [type] == "rsyslog\

my config file looks like this
input {
udp {
host => "0.0.0.0"
port => 10514
type => "rsyslog"
}
udp {
host => "0.0.0.0"
port => 12205
type => "gelf"
}
}

filter {}

output {
if [type] == "rsyslog" {
host => "172.16.0.27"
port => 12201
protocol => "tcp"
}
if [type] == "gelf" {
host => "172.16.0.27"
port => 12202
protocol => "tcp"
}
stdout {}

}
can someone suggest please!!

2

host is an option to an output. You have left out the output name.

3

so should I add a name field here like name => "syslog". I am very new to this.

Thanks in advance

4

If you want to use a syslog output then yes, change

host => "172.16.0.27"
port => 12201
protocol => "tcp"

to be

syslog {
host => "172.16.0.27"
port => 12201
protocol => "tcp"
}

Similarly for the type gelf

5

still the same error. btw how does it gets to know which input to convert into which output format when we have multiple inputs.

6

Exactly the same error? Same line and column numbers?

If you have multiple input and outputs then it sends events from all the inputs to all the outputs unless you use conditionals to change that.

7

ok thanks.. sorry, this time its different
logstash.outputs.gelf ] Invalid setting for gelf output plugin:

output {
gelf {
# This setting must be a ["TCP", "UDP"]
# Expected one of ["TCP", "UDP"], got ["tcp"]
protocol => "tcp"
...
}
}
[2019-02-13T16:15:11,315][ERROR][logstash.agent ] Cannot create pipeline {:reason=>"Something is wrong with your configuration."}

I have changed the typr from tcp to TCP still the error continues

8

I find that error goes away if you change "tcp" to "TCP". You may have to restart.

9

I have changed the config file and restarted the machine
but now it is saying something wrong with syslog output

output {
syslog {
# This setting must be a ["tcp", "udp", "ssl-tcp"]
# Expected one of ["tcp", "udp", "ssl-tcp"], got ["TCP"]
protocol => "TCP"
...
}
}

any idea?

10

For a gelf output protocol has to be TCP, for a tcp output it has to be tcp.

Logstash is full of little inconsistencies like this :slight_smile:

11

yea.. I was doing other way round.
Thanks a ton :slight_smile: .. now my logstash works fine.

12

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.