Using the syslog appender in elasticsearch

Elastic Stack Elasticsearch
1

I'm trying to log the Elasticsearch output via syslog to Papertrail.
The rest of the machine works just fine already - all syslog output
automatically goes to them via this rule:

. @logs.papertrailapp.com:xxxxx

Here is my ES logging config:

Nothing from Elasticsearch makes it over to Papertrail.

Anybody ever dealt with this?

Any pointers?

2

Hi,

you have to put 'syslog' in your rootLogger

Ludo

On Thu, Dec 29, 2011 at 4:52 AM, Darron Froese darron@nonfiction.ca wrote:

I'm trying to log the Elasticsearch output via syslog to Papertrail.
The rest of the machine works just fine already - all syslog output
automatically goes to them via this rule:

. @logs.papertrailapp.com:xxxxx

Here is my ES logging config:

http://d.pr/pXwe

Nothing from Elasticsearch makes it over to Papertrail.

Anybody ever dealt with this?

Any pointers?

3

Hmm - I've done that - it doesn't seem to work:

http://d.pr/yPkr

I think I'm putting things in the right place - any other ideas?

On Thu, Dec 29, 2011 at 7:47 AM, Ludovic Levesque luddic@gmail.com wrote:

Hi,

you have to put 'syslog' in your rootLogger

Ludo

On Thu, Dec 29, 2011 at 4:52 AM, Darron Froese darron@nonfiction.ca wrote:

I'm trying to log the Elasticsearch output via syslog to Papertrail.
The rest of the machine works just fine already - all syslog output
automatically goes to them via this rule:

. @logs.papertrailapp.com:xxxxx

Here is my ES logging config:

http://d.pr/pXwe

Nothing from Elasticsearch makes it over to Papertrail.

Anybody ever dealt with this?

Any pointers?

4

Do you see anything failing on the console output (run it in
the foreground)? I've never used log4j with syslog, but your config looks
good.

On Thu, Dec 29, 2011 at 9:33 PM, Darron Froese darron@nonfiction.ca wrote:

Hmm - I've done that - it doesn't seem to work:

http://d.pr/yPkr

I think I'm putting things in the right place - any other ideas?

On Thu, Dec 29, 2011 at 7:47 AM, Ludovic Levesque luddic@gmail.com
wrote:

Hi,

you have to put 'syslog' in your rootLogger

Ludo

On Thu, Dec 29, 2011 at 4:52 AM, Darron Froese darron@nonfiction.ca
wrote:

I'm trying to log the Elasticsearch output via syslog to Papertrail.
The rest of the machine works just fine already - all syslog output
automatically goes to them via this rule:

. @logs.papertrailapp.com:xxxxx

Here is my ES logging config:

http://d.pr/pXwe

Nothing from Elasticsearch makes it over to Papertrail.

Anybody ever dealt with this?

Any pointers?

5

Bumping this old thread with new info:

Darron's config is actually right on, except for one tiny thing. The
sysloghost line actually has to read: "syslogHost", with a capital H.
Works like a charm after that.

:slight_smile:

On Friday, December 30, 2011 7:38:07 AM UTC-5, kimchy wrote:

Do you see anything failing on the console output (run it in
the foreground)? I've never used log4j with syslog, but your config looks
good.

On Thu, Dec 29, 2011 at 9:33 PM, Darron Froese <dar...@nonfiction.ca<javascript:>

wrote:

Hmm - I've done that - it doesn't seem to work:

http://d.pr/yPkr

I think I'm putting things in the right place - any other ideas?

On Thu, Dec 29, 2011 at 7:47 AM, Ludovic Levesque <lud...@gmail.com<javascript:>>
wrote:

Hi,

you have to put 'syslog' in your rootLogger

Ludo

On Thu, Dec 29, 2011 at 4:52 AM, Darron Froese <dar...@nonfiction.ca<javascript:>>
wrote:

I'm trying to log the Elasticsearch output via syslog to Papertrail.
The rest of the machine works just fine already - all syslog output
automatically goes to them via this rule:

. @logs.papertrailapp.com:xxxxx

Here is my ES logging config:

http://d.pr/pXwe

Nothing from Elasticsearch makes it over to Papertrail.

Anybody ever dealt with this?

Any pointers?

--

6

Can someone post the working logging.yml for this?

I tried with

syslog:
type: syslog
sysloghost: localhost
facility: local1
layout:
type: pattern
conversionPattern: "[%d{ISO8601}][%-5p][%-25c] %m%n"

But nothing got pushed to syslog. My logs are going to /var/log/elasticsearch.log but nothing goes to syslog.

I need to push them to papertrail later using simple rsyslog forwarding.