# Rsyslog to logstash use mmsequence mod

**URL:** <https://discuss.elastic.co/t/rsyslog-to-logstash-use-mmsequence-mod/1680>\
**Category:** Logstash\
**Created:** [June 2, 2015, 1:08am UTC](https://discuss.elastic.co/t/rsyslog-to-logstash-use-mmsequence-mod/1680 "2015-06-02T01:08:37Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![lee62817](https://avatars.discourse-cdn.com/v4/letter/l/839c29/32.png) [@lee62817](https://discuss.elastic.co/u/lee62817)\
**Post date:** [June 2, 2015, 1:08am UTC](https://discuss.elastic.co/t/rsyslog-to-logstash-use-mmsequence-mod/1680/1 "2015-06-02T01:08:37Z")

</div>

HI!

i want to use rsyslog mmsequence & omfwd send log to logstash  
but nothing log send to logstash  
please help me to fix error !  
thank you

rsyslog os:centos 7 10.5.1.189  
elk os:centos 7 10.5.1.111

rsyslog.conf

#rsyslog configuration file

# For more information see /usr/share/doc/rsyslog-\*/rsyslog\_conf.html

$template insertpl,"insert into SystemEvents (Message, Facility, FromHost, FromIP, Priority, DeviceReportedTime, ReceivedAt, InfoUnitID, SysLogTag) values ('%msg%', %syslogfacility%, '%HOSTNAME%', '%fromhost-ip%', %syslogpriority%, '%timereported:::date-mysql%', '%timegenerated:::date-mysql%', %iut%, '%syslogtag%')",SQL

#### MODULES

$ModLoad ommysql  
_._:ommysql:localhost,Syslog,rsyslog,XXXXXXX;insertpl

# The imjournal module bellow is now used as a message source instead of imuxsock.

$ModLoad imuxsock # provides support for local system logging (e.g. via logger command)  
$ModLoad imjournal # provides access to the systemd journal  
#$ModLoad imklog # reads kernel messages (the same are read from journald)  
#$ModLoad immark # provides --MARK-- message capability  
$ModLoad immark

# Provides UDP syslog reception

#$ModLoad imudp  
#$UDPServerRun 514  
$ModLoad imudp  
$UDPServerRun 514

# Provides TCP syslog reception

$ModLoad imtcp  
$InputTCPServerRun 514  
$ModLoad omfwd  
$Modload mmsequence  
Ruleset( name="forwardRuleSet" ) {  
Action ( type="mmsequence" mode="instance" from="0" to="4" var="$.seq" )  
if $.seq == "0" then {  
action (type="omfwd" Target="10.5.1.111" Port="5511" Protocol="tcp" queue.size="150000" queue.dequeuebatchsize="2000" )  
}  
if $.seq == "1" then {  
action (type="omfwd" Target="10.5.1.111" Port="5512" Protocol="tcp" queue.size="150000" queue.dequeuebatchsize="2000" )  
}  
if $.seq == "2" then {  
action (type="omfwd" Target="10.5.1.111" Port="5513" Protocol="tcp" queue.size="150000" queue.dequeuebatchsize="2000" )  
}  
if $.seq == "3" then {  
action (type="omfwd" Target="10.5.1.111" Port="5514" Protocol="tcp" queue.size="150000" queue.dequeuebatchsize="2000" )  
}  
}

logstash.conf

input {  
tcp { port =\> "5511" type =\> "syslog" }  
tcp { port =\> "5512" type =\> "syslog" }  
tcp { port =\> "5513" type =\> "syslog" }  
tcp { port =\> "5514" type =\> "syslog" }  
}  
filter {  
if [type] == "syslog" {  
grok {  
match =\> { "message" =\> "%{SYSLOGTIMESTAMP:syslog\_timestamp} %{SYSLOGHOST:syslog\_hostname} %{DATA:syslog\_program}(?:[%{POSINT:syslog\_pid}])?: %{GREEDYDATA:syslog\_message}" }  
add\_field =\> ["received\_at", "%{@timestamp}"]  
add\_field =\> ["received\_from", "%{host}"]  
}  
syslog\_pri { }  
date {  
match =\> ["syslog\_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"]  
}  
}  
}  
output {  
redis {  
host =\> "localhost"  
data\_type =\> "list"  
key =\> "logstash"  
}  
}

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [June 2, 2015, 3:42am UTC](https://discuss.elastic.co/t/rsyslog-to-logstash-use-mmsequence-mod/1680/2 "2015-06-02T03:42:48Z")

</div>

Be systematic. Is rsyslog attempting to sending data to Logstash? Use tcpdump to confirm if you have to. Disable Logstash's redis output and use a plain stdout output to remove one error source and make sure you capture everything. Is there anything in the Logstash logs if you enable verbose logging with `--verbose` or `--debug`?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:38am UTC](https://discuss.elastic.co/t/rsyslog-to-logstash-use-mmsequence-mod/1680/3 "2017-07-06T05:38:50Z")

</div>

Closed on July 6, 2017, 5:38am UTC