Hello
I'm trying to get the syslog messages from a server to another using logstash.
The server where the logs come from is 130.190.224.91 (server1) the server where ELK is installed is 130.190.250.82 (elkserver)
I'm using rsyslogd on server1, and added . @@elkserver:5514 to /etc/rsyslog.conf
Here's my logstahs conf from elkserver
input {
udp {
port => 25826 # 25826 matches port specified in collectd.conf
buffer_size => 1452 # 1452 is the default buffer size for Collectd
codec => collectd { } # specific Collectd codec to invoke
type => collectd
}
syslog {
port => 5514
type => syslog
host => "130.190.250.82"
}
}
output {
elasticsearch {
hosts => ["130.190.250.82:9200"]
}
}
Error in /var/log/logstah.log
{:timestamp=>"2015-12-23T10:25:04.654000+0100", :message=>"retrying failed action with response code: 503", :level=>:warn}
i tested telnet server1 -> elkserver on port 5514, it works
on elkserver : lsof -nPi :5514
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
rsyslogd 1487 root 9u IPv4 32035 0t0 TCP 130.190.250.82:41415->130.190.250.82:5514 (ESTABLISHED)
java 6713 logstash 18u IPv6 33189 0t0 UDP 130.190.250.82:5514
java 6713 logstash 37u IPv6 33190 0t0 TCP 130.190.250.82:5514 (LISTEN)
java 6713 logstash 42u IPv6 33805 0t0 TCP 130.190.250.82:5514->130.190.224.91:35523 (ESTABLISHED)
java 6713 logstash 43u IPv6 33215 0t0 TCP 130.190.250.82:5514->130.190.224.91:35524 (ESTABLISHED)
java 6713 logstash 44u IPv6 33368 0t0 TCP 130.190.250.82:5514->130.190.250.82:41415 (ESTABLISHED)
