Logstash with syslog input doesn't send logs to Elasticsearch

Dear, I've configured Logstash 7.8.0 with a Syslog input, into an index called "syslog-514-xxxxx":

input {
udp {
port => 514
type => syslog
}
}

output {
elasticsearch {
hosts => [ "https://172.31.2.2:9200" ]
user => "elastic"
password => "xxx"
ssl => true
cacert => "/etc/ssl/certs/ca.crt"
manage_template => false
index => "syslog-514-%{+YYYY.MM.dd}"
}
}

If I execute tcpdumpo in ELK server, I can see logs coming from a rsyslog client to my UDP/514 port.

But if I execute tcpdump to view logs passing from port UDP/514 to port TCP/9200 (Elasticsearch 7.8.0), I can't see any traffic at all.

What can be the problem ?

The index syslog-514-xxxxx is populated by data, I can see this in the index management tab.

And also, how should I see the logs in Kibana? Where should I have to look for them?

Thanks in advance!!!

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.