Lumberjack plugin

Elastic Stack Logstash
1

I am trying to send Metricbeat ----> Logstash-1 -------> Logstash-2 -------> Elasticsearch.
I tried both tcp and Lumberjack protocols. Successfully start both logstshes but not found data in elasticsearch.
``````````lOGSTASH configuration using Lumberjack:``````````````````````
LOGSTASH-1 OUTPUT

output {
lumberjack {
codec => json
hosts => [ "X.X.X.X" ]
port => 5044
ssl_certificate => "/etc/logstash/conf.d/ca.crt"
}
}

LOGSTASH-2 CONFIGURATION::

input {
beats {
codec => json
port => 5044
ssl => true
ssl_certificate => "/etc/logstash/conf.d/USLA-PAPP-ELK03.crt"
ssl_key => "/etc/logstash/conf.d/pkcs8.key"
}
}
output {
elasticsearch {
hosts => ["node3:9200"]
manage_template => "false"
index => "%{[@metadata][beat]}-%{[@metadata][version]}"
user => "elastic"
password => "xxxxxx"
}
}


I am not able to see the data in kibana. Please help me. I tried both jason and json_lines but no luck.

How do i test logstash-1 sending data to logstash-2 and then to elasticsearch?

Issues until i resolved while using Lumberjack;
- no vaild key error:  assign cert and keys to logstash user permission
- use ca cert in logstash-1 output for ssl and http error.
2

While sending Logstash to logstash using Lumberjack below are few things to must be consider. For me it is working.

BEATS -->LOGSTASH-1 ---> LOGSTASH-2 --->ELASTICSEARCH

Generate certs for Logstash-2 input, use same certificate in Logstash-1 output.
Use logstash-2 ip address in Logstash-1 output.
After copying certs give the same file permissions as other files in /etc/logstash/conf.d/
Use the same port number in Logstash-1 input and output.
Use Beats input in Logstash-2.
Write your own config like input, filters in logstash-1 and filters, output in logstash-2.

Note: Follow the Logstash to logstash documentation in Elastic website.

3

openssl pkcs8 -v1 "PBE-SHA1-3DES" -in "ingeststar-key.pem" -topk8 -out "pkcs8.key" -nocrypt

another solution/reason for issue private key is invalid.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.