Need help in configuring the logstash on linux box

Elastic Stack Logstash
1

our plan is to install logstash and filter the /var/log/messages based on key words and it need to log to a file and mail should be sent if any filter matches

i am not able to configure also at this moment. could any one please help

2

Well, what have you got so far and what doesn't work? People are unlikely to step in and write all of your configuration files.

3

i am just trying basic only but not able to do...
Create a file named "logstash-simple.conf" and save it in the same directory as Logstash.
Then, run logstash and specify the configuration file with the -f flag.

bin/logstash -f logstash-simple.conf

i am not able to see anything

bin/logstash-2.0.0-1 -f logstash-simple.conf
-bash: bin/logstash-2.0.0-1: No such file or directory

4
  1. Your logstash binary isn't literally named "logstash-2.0.0-1", is it?
  2. Can you post the content of logstash-simple.conf?
5

in /bin directory i have created a folder with version of logstash-2.0.0-1 and created a .conf file with basic code as given in URL
input { stdin { } }
output {
elasticsearch { hosts => ["localhost:9200"] }
stdout { codec => rubydebug }
}

so as per document i am trying to execute the command "bin/logstash -f logstash-simple.conf"

6

Ok you need to run bin/logstash -f /path/to/logstash-simple.conf. The bin/logstash part is simply a convention or short hand for "invoke the logstash binary". If you saved the logstash directory under /bin, i suspect that your invocation should be /bin/logstash-2.0.0.1/bin/logstash -f /path/to/logstash-simple.conf. To confirm:

What is your absolute path to the logstash binary? and to logstash-simple.conf?

7

actually there is no binary path for my logstash

after installing rpm file in linux machine, i have created the folder logstash-2.0.0-1 in /bin directory and created a .conf file with the above said code

8

If you've installed logstash via the RPM, the default path for your conf is /etc/logstash/conf.d/ . You can put any configuration file in there and run "service logstash start"

9

Thank you vincent, now i am able to check that.

actually i am new to this can you guide me how to capture the data from /var/log/messages based on some keywords and send an email

steps:

  1. need to read the /var/log/messages for keywords like 'restart'/'event'
  2. capture the data from that message (above 5 lines and below 5 lines)
  3. captured data need to be written in to log file with timestamp
  4. that file need to be sent to mail

could you please help me how to do this basic code. I will enhance based on my requirement

10

Yep. First step starts here.