Hi All, please ignore the stupid use case as I only use this config for testing purposes.
I have an Ubuntu server with installed syslog-ng and Logstash.
I'd like to do the following:
I have a cronjob that on every minute manually add one log FW entry into one file ubuntu_in
Something like:
echo "blablba" >> ubuntu_in
I take this file in Syslog-ng as input (using File source driver) and get it on localhost:4444 (using network destination driver)
Logstash listens on localhost:4444 (using input plugin Syslog) and should write these logs to another file on the same Ubuntu server called ubuntu_out
These are my configurations
SYSLOG-NG
LOGSTASH (the file contains artifacts from another test but they are commented and plays no role here)
Is that scenario even possible?
I can't see file ubuntu_out anyway?
Could you please tell me what I do wrong?
I'm placing here just a simple test i did with lsof to see if both tools connect with each other and they seems to have although I am not a network expert.
Thank you in advance.