Questions tagged [logstash]

Logstash collects data from many types of logs, filters it, and outputs the result using many plugins. It is often associated with Elasticsearch and Kibana which have their own tags.

Filter by
Sorted by
Tagged with
0 votes
0 answers
12 views

Is is possible to avoid init.out logs in logstash?

I got logstash installed on Centos7, and running few data pipelines. Situation is,logstash is creating a default init.out file in logs dir, which is taking a log of space. # du -sh init.out 3.2G ...
user avatar
  • 1,603
1 vote
1 answer
70 views

How to make bash script invoking logstash return prompt

For various reasons, I am not running logstash (7.10.1) as a service, but rather invoking it on-demand, in a bash script: /usr/share/logstash/bin/logstash -f /etc/logstash/conf.d/my_ls.conf & echo ...
user avatar
  • 185
0 votes
1 answer
121 views

how to enable debug logs in stdout for logstash?

I'm struggling as newbie in logstash, below is some info of my env Logstash Version: logstash-7.16.2-1.x86_64 java Version: openjdk version "11.0.13" 2021-10-19 LTS Logstash Conf input { ...
user avatar
  • 1,603
0 votes
1 answer
99 views

prevent inode reuse

We are using Logstash to ingest our logs and we are facing some issues due inodes being reused. We tried all possible options on Logstash side so we are exploring the OS side. As far as I can see, if ...
user avatar
0 votes
0 answers
43 views

Nginx in UDP load balancing continue to send to an unreachable upstream server

I use Nginx to load balance traffic coming from udp syslog sources to logstash Configuration : user nginx; worker_processes auto; error_log /var/log/nginx/error.log; pid /run/nginx.pid; ...
user avatar
0 votes
0 answers
24 views

Unable to start logstash using /etc/init.d/logstash start

I'm trying to start the logstash service using below playbook. Output says starting but when I checked the status its in stopped state. But the same service I'm able to start it manually. --- - hosts:...
user avatar
  • 11
0 votes
0 answers
97 views

How to monitor a directory for changes across reboots?

I'm searching for a tool that will allow me to run a program for every change in a directory, but is guaranteed to run exactly once per change even across system reboots. For the purposes of this ...
user avatar
0 votes
0 answers
22 views

hearthbeat can't run

I have ELK server, and sending Heartbeats to server. I added an monitor in monitors.d directory, added setup.dashboards.enabled: true line in heartbeat.yml file, but after restarting heartbeat service,...
user avatar
0 votes
1 answer
5k views

what is GREEDYDATA in elasticsearch

reading the conf files of logstash i found in filter conf grok { match => { "message" => "Put\s*command\s*:\s+%{GREEDYDATA:command}" } } How does this filter work , i tried to ...
user avatar
  • 13
1 vote
1 answer
256 views

rsyslog error in logstash

I have installed ELK and tried to configure rsyslog server with logstash but i am getting lot of \ while executing curl -XGET 'http://172.22.63.61:9200/logstash-*/_search?q=*&pretty' Rsyslog ...
user avatar
0 votes
1 answer
56 views

Logstash output to nginx

I have 3 node and run cluster graylog-server. I use nginx for load balancer and on nginx open port (12301). i want to send log JSON format from logstash to this nginx then nginx, load balancer and ...
user avatar
  • 569
1 vote
1 answer
518 views

Logstash Unrecognized service Amazon Linux

I have been following this tutorial to install ELK stack in a remote server which runs on Amazon Linux. https://www.aytech.ca/blog/setup-elk-stack-amazon-linux/ I was able to install Elasticsearch and ...
user avatar
  • 115
0 votes
1 answer
795 views

problem re-loading index from filebeat in elasticsearch

I am using the ELK stack (more ELG stack as I am using Grafana as the front end instead of kibana for personal reasons). I am using Filebeat to send the logs file to Logstash which are then stored in ...
user avatar
0 votes
2 answers
566 views

How to configure Simple Event Correlator (SEC) to send info about mail delivery failure

My log file contains the following 3 log entries: 2017-11-16 15:50:45 1eFLV7-0003so-Cd <= <> R=1eFLV7-0003sZ-4v U=Debian-exim P=local S=1853 T="Mail delivery failed: returning message to ...
user avatar
  • 117
-1 votes
2 answers
21k views

How do i completely uninstall ELK (Elasticsearch, Logstash, Kibana)?

I search on internet that we have to unistall each of the ELK part one by one like unistall stand-alone kibana, elastic search, and logstash. Is there any command which no need to unistall all of them ...
user avatar
  • 215
1 vote
0 answers
942 views

logstash: Trying to extract substrings from path

I'm trying to extract substrings from my path field in my logstash config. The 'path' field looks like this: /storage/logs/deployment/servers/hostname.example.com/server.log Inside a filter section ...
user avatar
  • 1,467
2 votes
0 answers
2k views

Rsyslog doesn't send logs to logstash server on port

I have two rsyslog-client and rsyslog-server. When I tried to "logger -p local1.notice SOMETHING" I don't see any information on server from one client, but from another I see logstash output. I have ...
user avatar
0 votes
1 answer
482 views

Kibana- Want to split vertical bars based on my log fields

I have an application log file consists of following log levels: INFO, WARN, ERROR, DEBUG. Following filter criteria works fine in logstash config file: filter { grok { match => { "...
user avatar
  • 335
0 votes
1 answer
195 views

logstash - take 2 - filter to send messages from IntelMQ/python/redis to ELK

Following up on the heels of this question, https://stackoverflow.com/questions/40768603/logstash-trying-to-make-sense-of-strings-passed-by-intelmq-in-elasticsearch I am trying to create a refine/...
user avatar
1 vote
1 answer
729 views

geoip logstash filter not working in Debian

I am trying to setup the geoip filter for logstashin Debian Stretch, as per this question I installed the geoip-database package, however logstash logs complain of wrong database format. What to do?
user avatar
1 vote
1 answer
255 views

Tile/Greographic Map in Kibana not working

I am trying to create a geographical map of my data in Kibana 5.01, and it does not work. The fact is that I do not even have the geoip.field that is required in the menu. I am sending data from ...
user avatar
1 vote
2 answers
3k views

logstash regex match in if condition

In logstash filtering, I have multiple tags setup based upon different error conditions and all the tags has a prefix, something like "abc:" In the output, I want to send email based upon just "abc:*"...
user avatar