Transfer Unix messages to ELS

[bigsol (Solomon)]

Hello all,
I need your help to understand how I forward UNIX SYSTEM (SOLARIS) messages to ELS?

Thanks

[magnusbaeck (Magnus Bäck)]

Are you talking about syslog messages? And ELS means Elasticsearch?

https://www.elastic.co/guide/en/logstash/current/config-examples.html should give you some inspiration. The syslog example there sets up network listeners but if you're running Logstash on the Solaris host you could read from local files instead with a file input plugin.

[bigsol (Solomon)]

Does that mean I need to install Logstash + Plugin syslog on each UNIX server?

[magnusbaeck (Magnus Bäck)]

No. You can configure the local syslog daemon to ship the messages over the network. Another option is to install Filebeat to ship the logs from disk.

There are many ways of doing this. The sooner you tell us what particular requirements you quicker things go.

[bigsol (Solomon)]

Does LOGSTASH know to accept syslog events?

[magnusbaeck (Magnus Bäck)]

The link I posted contains an example of just that.

[bigsol (Solomon)]

Thank you,