I'm new to ELK, and I am trying to set up multiple index sources (from netflow sources and from snmp via collectd). Seems like the info polled from SNMP is missing ...fields don't show up) I have the following setup:
CentOS 7
collectd-5.5.1-2.el7.x86_64 (polling for snmp)
logstash-1.5.4-1.noarch
elasticsearch-2.2.1-1.noarch
kibana-4.4.2-1.x86_64
When I upstart logstash from systemctl it starts fine, but it looks like no data is being pushed into ES. If I manually run logstash pointing to the conf file data is populated normally into ES.
Here is my logstash config:
`input {
udp {
port => 9997
codec => netflow {
definitions => "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-codec-netflow-1.0.0/lib/logstash/codecs/netflow/netflow.yaml"
versions => [5]
}
}
udp {
port => 25826 # Must be specified. 25826 is the default for collectd
buffer_size => 1452 # Should be specified. 1452 is the default for recent versions of collectd
codec => collectd { } # This will invoke the default options for the codec
type => "collectd"
}
}
filter {
mutate {
convert => {
"[netflow][ipv4_src_addr]" => "string"
"[netflow][ipv4_dst_addr]" => "string"
}
}
geoip {
source => "[netflow][ipv4_src_addr]"
target => "src_geoip"
database => "/etc/logstash/GeoLiteCity.dat"
}
geoip {
source => "[netflow][ipv4_dst_addr]"
target => "dst_geoip"
database => "/etc/logstash/GeoLiteCity.dat"
}
#mutate {
#convert => [ "[geoip][coordinates]", "float"]
#}
}
output {
stdout { codec => rubydebug }
if [type] == "collectd" {
elasticsearch {
index => "logstash_collectd-%{+YYYY.MM.dd}"
host => "localhost"
protocol => http
}
} else {
elasticsearch {
index => "logstash_netflow-%{+YYYY.MM.dd}"
host => "localhost"
protocol => http
}
}
}`
Can anyone help?