Mmmm my setup is like this elkserver.example.com (That server hosts Elesticsearch, Logstash and Kibana) and elkclient (Only has filebeat)
In elkclient.example.com with only /var/log/messages path
tail -f /var/log/messages
Jun 13 11:31:25 elkclient systemd: Time has been changed
Jun 13 11:31:25 elkclient chronyd[813]: System clock was stepped by 14401.230573 seconds
Jun 13 11:31:32 elkclient systemd: Created slice user-1000.slice.
Jun 13 11:31:32 elkclient systemd: Starting user-1000.slice.
Jun 13 11:31:32 elkclient systemd: Started Session 2 of user cnscadmin.
Jun 13 11:31:32 elkclient systemd-logind: New session 2 of user cnscadmin.
Jun 13 11:31:32 elkclient systemd: Starting Session 2 of user cnscadmin.
Jun 13 11:31:33 elkclient bash[1300]: cnscadmin [ 192.168.7.126 ] : #011 su -
Jun 13 11:31:37 elkclient su: (to root) cnscadmin on pts/0
Jun 13 11:31:38 elkclient bash[1359]: root [ ] : #011 systemctl reboot
In elkserver.example.com
curl -XGET 'http://localhost:9200/filebeat-*/_search?pretty':
{
"took" : 3,
"timed_out" : false,
"_shards" : {
"total" : 50,
"successful" : 50,
"failed" : 0
},
"hits" : {
"total" : 42218,
"max_score" : 1.0,
"hits" : [
{
"_index" : "filebeat-2017.05.25",
"_type" : "log",
"_id" : "AVxBPPh4yM45-hZBb-Ff",
"_score" : 1.0,
"_source" : {
"@timestamp" : "2017-05-25T20:12:08.669Z",
"beat" : {
"hostname" : "elk.example.com",
"name" : "elk.example.com",
"version" : "5.4.0"
},
"input_type" : "log",
"message" : "Aug 01 10:40:01 Updated: systemd-libs-219-19.el7_2.11.x86_64",
"offset" : 300,
"source" : "/var/log/yum.log",
"type" : "log"
}
},
{
"_index" : "filebeat-2017.05.25",
"_type" : "log",
"_id" : "AVxBPPh4yM45-hZBb-Fh",
"_score" : 1.0,
"_source" : {
"@timestamp" : "2017-05-25T20:12:08.669Z",
"beat" : {
"hostname" : "elk.example.com",
"name" : "elk.example.com",
"version" : "5.4.0"
},
"input_type" : "log",
"message" : "Aug 01 10:40:01 Updated: nss-util-3.21.0-2.2.el7_2.x86_64",
"offset" : 410,
"source" : "/var/log/yum.log",
"type" : "log"
}
},
{
"_index" : "filebeat-2017.05.25",
"_type" : "log",
"_id" : "AVxBPPh4yM45-hZBb-Fj",
"_score" : 1.0,
"_source" : {
"@timestamp" : "2017-05-25T20:12:08.669Z",
"beat" : {
"hostname" : "elk.example.com",
"name" : "elk.example.com",
"version" : "5.4.0"
},
"input_type" : "log",
"message" : "Aug 01 10:40:01 Updated: libgudev1-219-19.el7_2.11.x86_64",
"offset" : 526,
"source" : "/var/log/yum.log",
"type" : "log"
}
},
{
"_index" : "filebeat-2017.05.25",
"_type" : "log",
"_id" : "AVxBPPh4yM45-hZBb-Fk",
"_score" : 1.0,
"_source" : {
"@timestamp" : "2017-05-25T20:12:08.669Z",
"beat" : {
"hostname" : "elk.example.com",
"name" : "elk.example.com",
"version" : "5.4.0"
},
"input_type" : "log",
"message" : "[\u001B[32m OK \u001B[0m] Started Show Plymouth Boot Screen.",
"offset" : 54,
"source" : "/var/log/boot.log",
"type" : "log"
}
},
{
"_index" : "filebeat-2017.05.25",
"_type" : "log",
"_id" : "AVxBPPh4yM45-hZBb-Fm",
"_score" : 1.0,
"_source" : {
"@timestamp" : "2017-05-25T20:12:08.669Z",
"beat" : {
"hostname" : "elk.example.com",
"name" : "elk.example.com",
"version" : "5.4.0"
},
"input_type" : "log",
"message" : "Aug 01 10:40:02 Updated: libxml2-2.9.1-6.el7_2.3.x86_64",
"offset" : 640,
"source" : "/var/log/yum.log",
"type" : "log"
}
},
{
"_index" : "filebeat-2017.05.25",
"_type" : "log",
"_id" : "AVxBPPh4yM45-hZBb-Fv",
"_score" : 1.0,
"_source" : {
"@timestamp" : "2017-05-25T20:12:08.669Z",
"beat" : {
"hostname" : "elk.example.com",
"name" : "elk.example.com",
"version" : "5.4.0"
},
"input_type" : "log",
"message" : "[\u001B[32m OK \u001B[0m] Reached target Remote File Systems.",
"offset" : 512,
"source" : "/var/log/boot.log",
"type" : "log"
}
},
{
"_index" : "filebeat-2017.05.25",
"_type" : "log",
"_id" : "AVxBPPh4yM45-hZBb-F0",
"_score" : 1.0,
"_source" : {
"@timestamp" : "2017-05-25T20:12:08.669Z",
"beat" : {
"hostname" : "elk.example.com",
"name" : "elk.example.com",
"version" : "5.4.0"
},
"input_type" : "log",
"message" : "Aug 01 10:40:14 Updated: pcre-8.32-15.el7_2.1.x86_64",
"offset" : 814,
"source" : "/var/log/yum.log",
"type" : "log"
}
},
}
]
}
}
In Kibana:
Table:
JSON:
{
"_index": "filebeat-2017.06.13",
"_type": "syslog",
"_id": "AVyiSt1v_ojTDgCejFaf",
"_version": 1,
"_score": null,
"_source": {
"syslog_pid": "1407",
"syslog_severity_code": 5,
"offset": 78,
"syslog_facility": "user-level",
"count": 1,
"input_type": "log",
"syslog_facility_code": 1,
"source": "/var/log/messages",
"syslog_program": "bash",
"message": "Jun 13 11:29:45 elkclient bash[1407]: root [ ] : #011 echo "" > /var/log/messages",
"type": "syslog",
"syslog_message": "root [ ] : #011 echo "" > /var/log/messages",
"syslog_severity": "notice",
"tags": [
"beats_input_codec_plain_applied"
],
"received_from": "elkclient.example.com",
"@timestamp": "2017-06-13T16:29:45.000Z",
"syslog_hostname": "elkclient",
"syslog_timestamp": "Jun 13 11:29:45",
"received_at": "2017-06-13T12:30:30.614Z",
"@version": "1",
"beat": {
"hostname": "elkclient.example.com",
"name": "elkclient.example.com"
},
"host": "elkclient.example.com",
"fields": null
},
"fields": {
"@timestamp": [
1497371385000
]
},
"sort": [
1497371385000
]
}