Monitoring connection between syslog and ELK stack

(Jitender Kumar) #1

I am new to ELK. I have my ELK stack working and polling logs using rsyslog.
How do I monitor connection from several servers(using rsyslog) to logstash. I am looking for an alert when xxx host stops sending logs to ELK for last 30 minutes or so.

(Magnus B├Ąck) #2

Logstash itself isn't able to do this (with the standard plugins), but you can easily hook up Logstash to Lovebeat and have the latter detect when the per-host message frequency changes too much from the norm.

(system) #3