Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [logstash]

Logstash collects data from many types of logs, filters it, and outputs the result using many plugins. It is often associated with Elasticsearch and Kibana which have their own tags.

0
votes
1answer
16 views

Logstash output to nginx

I have 3 node and run cluster graylog-server. I use nginx for load balancer and on nginx open port (12301). i want to send log JSON format from logstash to this nginx then nginx, load balancer and ...
1
vote
1answer
140 views

Logstash Unrecognized service Amazon Linux

I have been following this tutorial to install ELK stack in a remote server which runs on Amazon Linux. https://www.aytech.ca/blog/setup-elk-stack-amazon-linux/ I was able to install Elasticsearch and ...
0
votes
0answers
145 views

LogStash Json ParserError

I need to send a log with JSON format from rsyslog to logsatsh and then from logstash to graylog. All the steps I have done. step 1 : config /etc/rsyslog.conf *.* action(type="omfwd" target="192....
0
votes
1answer
191 views

problem re-loading index from filebeat in elasticsearch

I am using the ELK stack (more ELG stack as I am using Grafana as the front end instead of kibana for personal reasons). I am using Filebeat to send the logs file to Logstash which are then stored in ...
0
votes
2answers
286 views

How to configure Simple Event Correlator (SEC) to send info about mail delivery failure

My log file contains the following 3 log entries: 2017-11-16 15:50:45 1eFLV7-0003so-Cd <= <> R=1eFLV7-0003sZ-4v U=Debian-exim P=local S=1853 T="Mail delivery failed: returning message to ...
-2
votes
1answer
4k views

How do i completely uninstall ELK?

I search on internet that we have to unistall each of the ELK part one by one like unistall stand-alone kibana, elastic search, and logstash. Is there any command which no need to unistall all of them ...
1
vote
0answers
550 views

logstash: Trying to extract substrings from path

I'm trying to extract substrings from my path field in my logstash config. The 'path' field looks like this: /storage/logs/deployment/servers/hostname.example.com/server.log Inside a filter section ...
2
votes
0answers
952 views

Rsyslog doesn't send logs to logstash server on port

I have two rsyslog-client and rsyslog-server. When I tried to "logger -p local1.notice SOMETHING" I don't see any information on server from one client, but from another I see logstash output. I have ...
0
votes
1answer
326 views

Kibana- Want to split vertical bars based on my log fields

I have an application log file consists of following log levels: INFO, WARN, ERROR, DEBUG. Following filter criteria works fine in logstash config file: filter { grok { match => { "...
0
votes
1answer
154 views

logstash - take 2 - filter to send messages from IntelMQ/python/redis to ELK

Following up on the heels of this question, https://stackoverflow.com/questions/40768603/logstash-trying-to-make-sense-of-strings-passed-by-intelmq-in-elasticsearch I am trying to create a refine/...
0
votes
1answer
544 views

geoip logstash filter not working in Debian

I am trying to setup the geoip filter for logstashin Debian Stretch, as per this question I installed the geoip-database package, however logstash logs complain of wrong database format. What to do?
0
votes
1answer
218 views

Tile/Greographic Map in Kibana not working

I am trying to create a geographical map of my data in Kibana 5.01, and it does not work. The fact is that I do not even have the geoip.field that is required in the menu. I am sending data from ...
2
votes
1answer
2k views

logstash regex match in if condition

In logstash filtering, I have multiple tags setup based upon different error conditions and all the tags has a prefix, something like "abc:" In the output, I want to send email based upon just "abc:*"...