Normalize the logs with ELK

Elastic Stack Logstash
41

Move all files out of /etc/logstash/conf.d/ to a backup location.

Create on new file with the following content in /etc/logstash/conf.d/

input {
  beats {
    port => 5044
  }
  udp {
    port => 1514
  }
}
filter {}
output {
  elasticsearch {
  }
}

That should work with the defaults for the elasticsearch output as long as you have Elasticsearch running on the same machine as Logstash.

Restart Logstash. Check that you can connect to UDP port 1514.

The official Logstash documentation is quite good. There is a lot of it so it takes time to get through it. You don't really need to read everything though as you only use small parts of it.

1 Like
42

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.