# LS not ingesting syslog

**URL:** <https://discuss.elastic.co/t/ls-not-ingesting-syslog/158742>\
**Category:** Logstash\
**Created:** [November 29, 2018, 11:37am UTC](https://discuss.elastic.co/t/ls-not-ingesting-syslog/158742 "2018-11-29T11:37:21Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![blueren](https://avatars.discourse-cdn.com/v4/letter/b/ecae2f/32.png) [@blueren](https://discuss.elastic.co/u/blueren)\
**Post date:** [November 29, 2018, 11:37am UTC](https://discuss.elastic.co/t/ls-not-ingesting-syslog/158742/1 "2018-11-29T11:37:21Z")

</div>

Hi,

I've installed this on a docker container, this is the current docker-compose.yaml:

```auto
version: '2'
services:
  elasticsearch:
    image: elasticsearch-img:6.3.2
    container_name: elasticsearch-container
    volumes:
      - /data/elasticsearch-1/:/usr/share/elasticsearch/data
    ports: 
      - 9200:9200 #Elasticsearch HTTP
      - 9300:9300 #Elasticsearch TCP transport
    network_mode: bridge
    restart: always
    environment:
      # - cluster.name=docker-cluster
      # - bootstrap.memory_lock=true
      - "ES_JAVA_OPTS=-Xms4g -Xmx4g"
    ulimits:
      memlock:
        soft: -1
        hard: -1
    
  logstash:
    image: logstash-img:6.3.2
    container_name: logstash-container
    ports:
      - 5000:5000 #logstash TCP input
      - 514:5140 #listent to syslog on 514(host) map it to 5140(container) 541 is reserved and needs root
      - 514:5140/udp #listent to syslog on 514(host) map it to 5140(container) 541 is reserved and needs root
    restart: always #restarts on reboot
    environment:
      - "LS_JAVA_OPTS=-Xms8g -Xmx8g"
      - "SYNLITE_SYSLOG_TEMPLATE_PATH=/usr/share/logstash/syslog/templates"
      - "SYNLITE_SYSLOG_GROK_PATTERNS_DIR=/usr/share/logstash/syslog/patterns"
      - "SYNLITE_SYSLOG_RESOLVE_IP2HOST=true"
      - "SYNLITE_SYSLOG_NAMESERVER=8.8.8.8"
      - "SYNLITE_SYSLOG_ES_HOSTS=elasticsearch:9200"
      # - "SYNLITE_SYSLOG_ES_USER=elastic"
      # - "SYNLITE_SYSLOG_ES_PASSWORD=changeme"
      - "SYNLITE_SYSLOG_TCP_HOST=0.0.0.0"
      - "SYNLITE_SYSLOG_TCP_PORT=514"
      - "SYNLITE_SYSLOG_UDP_HOST=0.0.0.0"
      - "SYNLITE_SYSLOG_UDP_PORT=514"
      - "SYNLITE_SYSLOG_MSG_TIMESTAMP=true"
      - "SYNLITE_SYSLOG_TZ=UTC"
    network_mode: bridge 
    links:
    - elasticsearch
    depends_on:
    - elasticsearch

```

Initially, port mapping of `514:514` made docker crib stating that permission was denied. I'm guessing this is because it's a port \< 1000 and hence is previlaged. I've mapped `514:5140` within the container.

My /etc/rsyslog.conf looks like below:

```auto
...
...
# provides UDP syslog reception
module(load="imudp")
input(type="imudp" port="514")

# provides TCP syslog reception
module(load="imtcp")
input(type="imtcp" port="514")
...
...

```

I'm able to see syslog being written on to `/var/log/syslog` . It works when I do something like: `logger -s " This is a test "`

However, I do not see anyting being picked up by LS/ES. What am I missing?

Thanks

---

<div class="post-metadata">

**Author:** ![Eniqmatic](https://avatars.discourse-cdn.com/v4/letter/e/ea5d25/32.png) [@Eniqmatic](https://discuss.elastic.co/u/Eniqmatic)\
**Post date:** [November 29, 2018, 12:17pm UTC](https://discuss.elastic.co/t/ls-not-ingesting-syslog/158742/2 "2018-11-29T12:17:55Z")

</div>

Can you post your logstash config otherwise we cannot help.

---

<div class="post-metadata">

**Author:** ![blueren](https://avatars.discourse-cdn.com/v4/letter/b/ecae2f/32.png) [@blueren](https://discuss.elastic.co/u/blueren)\
**Post date:** [November 29, 2018, 12:23pm UTC](https://discuss.elastic.co/t/ls-not-ingesting-syslog/158742/3 "2018-11-29T12:23:18Z")

</div>

Oh, sorry. Yes. It's exactly as how it is [here](https://github.com/koiossian/synesis_lite_syslog/tree/master/logstash/synesis_lite_syslog/conf.d) - I believe this is more to do with my rsyslog coniguration on the machine rather than ELK itself

---

<div class="post-metadata">

**Author:** ![Eniqmatic](https://avatars.discourse-cdn.com/v4/letter/e/ea5d25/32.png) [@Eniqmatic](https://discuss.elastic.co/u/Eniqmatic)\
**Post date:** [November 29, 2018, 12:24pm UTC](https://discuss.elastic.co/t/ls-not-ingesting-syslog/158742/4 "2018-11-29T12:24:15Z")

</div>

Still need to see the logstash config

---

<div class="post-metadata">

**Author:** ![blueren](https://avatars.discourse-cdn.com/v4/letter/b/ecae2f/32.png) [@blueren](https://discuss.elastic.co/u/blueren)\
**Post date:** [November 29, 2018, 12:28pm UTC](https://discuss.elastic.co/t/ls-not-ingesting-syslog/158742/5 "2018-11-29T12:28:31Z")

</div>

I've put up the correct link in the previous reply.

Here it is below:

```
input {
  # Listen on TCP/514 for syslog messages.
  tcp {
    id => "tcp_syslog"
    host => "${SYNLITE_SYSLOG_TCP_HOST:0.0.0.0}"
    port => "${SYNLITE_SYSLOG_TCP_PORT:514}"
    type => "syslog"
  }

  # Listen on UDP/514 for syslog messages.
  udp {
    id => "udp_syslog"
    host => "${SYNLITE_SYSLOG_UDP_HOST:0.0.0.0}"
    port => "${SYNLITE_SYSLOG_UDP_PORT:514}"
    type => "syslog"
  }
}

<<a whole lot of filters>>

output {
  elasticsearch {
    id => "output_elasticsearch"
    hosts => ["${SYNLITE_SYSLOG_ES_HOSTS:127.0.0.1:9200}"]
    user => "${SYNLITE_SYSLOG_ES_USER:elastic}"
    password => "${SYNLITE_SYSLOG_ES_PASSWORD:changeme}"
    index => "syslog-%{+YYYY.MM.dd}"
    template => "${SYNLITE_SYSLOG_TEMPLATE_PATH:/etc/logstash/synesis_lite_syslog/templates}/synesis_lite_syslog.template.json"
    template_name => "synesis_lite_syslog"
    template_overwrite => "true"
  }
}
```

---

<div class="post-metadata">

**Author:** ![Eniqmatic](https://avatars.discourse-cdn.com/v4/letter/e/ea5d25/32.png) [@Eniqmatic](https://discuss.elastic.co/u/Eniqmatic)\
**Post date:** [November 29, 2018, 12:29pm UTC](https://discuss.elastic.co/t/ls-not-ingesting-syslog/158742/6 "2018-11-29T12:29:46Z")

</div>

I'm unsure about the use of variables in the config, have you tried putting in IP Addresses to test first?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 27, 2018, 12:29pm UTC](https://discuss.elastic.co/t/ls-not-ingesting-syslog/158742/7 "2018-12-27T12:29:56Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.