Dear Friends,
I already send my application and IIS logs to elasticsearch without any problem. Currently, i'm trying to send windows eventviwer logs to elasticsearch. But interestingly when I start to logstash, logs can not go to elasticsearch properly.
When i remove my iis logstash config file winlog beat works properly. Similarly, when i remove my winlogbeat config file filebeat works properly. But when i start to logstash both filebeat and winlogbeat configs logs can't go to elasticsearch properly.
Have you got any idea how can fix this problem. my config files are below
Filebeat Config:
indent preformatted text by 4 spaces
input {
beats {
port => 5044
}
}
output {
if "_grokparsefailure" in [tags] {
stdout {
codec => rubydebug
}
}
else {
elasticsearch {
index => "iis-%{+YYYY.MM.dd}"
hosts => ["10.2.1.148:9200","10.2.1.149:9200","10.2.1.152:9200"]
}
}
}
winlogbeat config:
indent preformatted text by 4 spaces
input {
beats {
port => 5050
}
}
output {
if "_jsonparsefailure" in [tags] {
stdout { codec => rubydebug }
}
elseif [type] == "wineventlog" {
elasticsearch {
index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
document_type => "%{[@metadata][type]}"
manage_template => false
template => "/etc/logstash/templates/winlogbeat.template.json"
template_overwrite => true
hosts => ["10.2.1.148:9200","10.2.1.149:9200","10.2.1.152:9200"]
}
stdout { codec => rubydebug }
} else {
stdout { codec => rubydebug }
}
}
Json config:
indent preformatted text by 4 spaces
input {
udp {
port => 5960
codec => "json"
type => "json"
}
}
output {
if "_jsonparsefailure" in [tags] {
stdout { codec => rubydebug }
} elseif [type] == "json" {
elasticsearch {
hosts => ["10.2.1.148:9200","10.2.1.149:9200","10.2.1.152:9200"]
template => "/etc/logstash/templates/template.json" }
} else {
stdout { codec => rubydebug }
}
}