Questions tagged [logstash]

Logstash collects data from many types of logs, filters it, and outputs the result using many plugins. It is often associated with Elasticsearch and Kibana which have their own tags.

Filter by
Sorted by
Tagged with
0
votes
1answer
170 views

what is GREEDYDATA in elasticsearch

reading the conf files of logstash i found in filter conf grok { match => { "message" => "Put\s*command\s*:\s+%{GREEDYDATA:command}" } } How does this filter work , i tried to ...
1
vote
1answer
81 views

rsyslog error in logstash

I have installed ELK and tried to configure rsyslog server with logstash but i am getting lot of \ while executing curl -XGET 'http://172.22.63.61:9200/logstash-*/_search?q=*&pretty' Rsyslog ...
0
votes
1answer
28 views

Logstash output to nginx

I have 3 node and run cluster graylog-server. I use nginx for load balancer and on nginx open port (12301). i want to send log JSON format from logstash to this nginx then nginx, load balancer and ...
1
vote
1answer
283 views

Logstash Unrecognized service Amazon Linux

I have been following this tutorial to install ELK stack in a remote server which runs on Amazon Linux. https://www.aytech.ca/blog/setup-elk-stack-amazon-linux/ I was able to install Elasticsearch and ...
0
votes
1answer
360 views

problem re-loading index from filebeat in elasticsearch

I am using the ELK stack (more ELG stack as I am using Grafana as the front end instead of kibana for personal reasons). I am using Filebeat to send the logs file to Logstash which are then stored in ...
0
votes
2answers
408 views

How to configure Simple Event Correlator (SEC) to send info about mail delivery failure

My log file contains the following 3 log entries: 2017-11-16 15:50:45 1eFLV7-0003so-Cd <= <> R=1eFLV7-0003sZ-4v U=Debian-exim P=local S=1853 T="Mail delivery failed: returning message to ...
-1
votes
2answers
8k views

How do i completely uninstall ELK?

I search on internet that we have to unistall each of the ELK part one by one like unistall stand-alone kibana, elastic search, and logstash. Is there any command which no need to unistall all of them ...
1
vote
0answers
735 views

logstash: Trying to extract substrings from path

I'm trying to extract substrings from my path field in my logstash config. The 'path' field looks like this: /storage/logs/deployment/servers/hostname.example.com/server.log Inside a filter section ...
2
votes
0answers
1k views

Rsyslog doesn't send logs to logstash server on port

I have two rsyslog-client and rsyslog-server. When I tried to "logger -p local1.notice SOMETHING" I don't see any information on server from one client, but from another I see logstash output. I have ...
0
votes
1answer
398 views

Kibana- Want to split vertical bars based on my log fields

I have an application log file consists of following log levels: INFO, WARN, ERROR, DEBUG. Following filter criteria works fine in logstash config file: filter { grok { match => { "...
0
votes
1answer
163 views

logstash - take 2 - filter to send messages from IntelMQ/python/redis to ELK

Following up on the heels of this question, https://stackoverflow.com/questions/40768603/logstash-trying-to-make-sense-of-strings-passed-by-intelmq-in-elasticsearch I am trying to create a refine/...
1
vote
1answer
637 views

geoip logstash filter not working in Debian

I am trying to setup the geoip filter for logstashin Debian Stretch, as per this question I installed the geoip-database package, however logstash logs complain of wrong database format. What to do?
1
vote
1answer
238 views

Tile/Greographic Map in Kibana not working

I am trying to create a geographical map of my data in Kibana 5.01, and it does not work. The fact is that I do not even have the geoip.field that is required in the menu. I am sending data from ...
1
vote
1answer
2k views

logstash regex match in if condition

In logstash filtering, I have multiple tags setup based upon different error conditions and all the tags has a prefix, something like "abc:" In the output, I want to send email based upon just "abc:*"...