Syslog configuration output

Elastic Stack Logstash
1

Hi All,
i'm a newbie of elastic world and i'm trying to grab some remote syslog logs to visualize them on kibana. I setup logstash with a configuration file like this:
input {
tcp {
port => 514
type => syslog
}
udp {
port => 514
type => syslog
}
}

filter {
if [type] == "syslog" {
grok {
match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:[%{POSINT:syslog_pid}])
?: %{GREEDYDATA:syslog_message}" }
add_field => [ "received_at", "%{@timestamp}" ]
add_field => [ "received_from", "%{host}" ]
}
date {
match => [ "syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss" ]
}
}
}

output {
elasticsearch { hosts => ["localhost:9200"] }
stdout { codec => rubydebug }
}

ELK stack is installed on ubuntu server and if i start the service with "service logstash start" it seems to go wrong. Following some guides on internet i tried to run the daemon with the option -f and specify configuration file. In this case i can see syslog messagges via CLI but i don't know how to pass them to ES.

Is it the configuration pasted wrong?
Thanks a lot!

Fabio

2

"It seems to go wrong" is not a useful problem description. Please consult the Logstash logs to get more information about what's up.

In this particular case the problem is most likely that Logstash can't listen on port 514 (or any other port < 1024) unless it's run as root or if you use one of the workarounds that are available (this is not specific to Logstash so you should find plenty of hints on e.g. StackOverflow).