@Lukas I am pretty sure the error is coming from my logstash.conf and how is configured
input {
syslog {
port => 3014
codec => cef
syslog_field => "syslog"
grok_pattern => "<%{POSINT:priority}>%{SYSLOGTIMESTAMP:timestamp} CUSTOM GROK HERE"
}
}
output {
elasticsearch {
hosts => ["localhost:9200"]
index => "logstash_index"
}
}
Any advice how I can configure this to receive all and any data coming through the port 3014?