Questions tagged [logstash]

Logstash collects data from many types of logs, filters it, and outputs the result using many plugins. It is often associated with Elasticsearch and Kibana which have their own tags.

Filter by
Sorted by
Tagged with
0
votes
0answers
17 views

How to monitor a directory for changes across reboots?

I'm searching for a tool that will allow me to run a program for every change in a directory, but is guaranteed to run exactly once per change even across system reboots. For the purposes of this ...
0
votes
0answers
108 views

Configure ingest manager in elasticseach 7.9

I have configured ELK on a single VM ( Centos 7 / 10Gig / 4 CPU) along with filebeat and auditbeat as POC and encountered the below error while trying to use the ingest manager. I followed the ...
0
votes
0answers
15 views

hearthbeat can't run

I have ELK server, and sending Heartbeats to server. I added an monitor in monitors.d directory, added setup.dashboards.enabled: true line in heartbeat.yml file, but after restarting heartbeat service,...
0
votes
0answers
39 views

parse multiline events logs using logstash

input { file { path => "/tmp/test.log" start_position => "beginning" codec => multiline { pattern => "^%{TIME} " negate => true ...
0
votes
1answer
2k views

what is GREEDYDATA in elasticsearch

reading the conf files of logstash i found in filter conf grok { match => { "message" => "Put\s*command\s*:\s+%{GREEDYDATA:command}" } } How does this filter work , i tried to ...
1
vote
1answer
196 views

rsyslog error in logstash

I have installed ELK and tried to configure rsyslog server with logstash but i am getting lot of \ while executing curl -XGET 'http://172.22.63.61:9200/logstash-*/_search?q=*&pretty' Rsyslog ...
0
votes
1answer
37 views

Logstash output to nginx

I have 3 node and run cluster graylog-server. I use nginx for load balancer and on nginx open port (12301). i want to send log JSON format from logstash to this nginx then nginx, load balancer and ...
1
vote
1answer
408 views

Logstash Unrecognized service Amazon Linux

I have been following this tutorial to install ELK stack in a remote server which runs on Amazon Linux. https://www.aytech.ca/blog/setup-elk-stack-amazon-linux/ I was able to install Elasticsearch and ...
0
votes
1answer
660 views

problem re-loading index from filebeat in elasticsearch

I am using the ELK stack (more ELG stack as I am using Grafana as the front end instead of kibana for personal reasons). I am using Filebeat to send the logs file to Logstash which are then stored in ...
0
votes
2answers
487 views

How to configure Simple Event Correlator (SEC) to send info about mail delivery failure

My log file contains the following 3 log entries: 2017-11-16 15:50:45 1eFLV7-0003so-Cd <= <> R=1eFLV7-0003sZ-4v U=Debian-exim P=local S=1853 T="Mail delivery failed: returning message to ...
-1
votes
2answers
14k views

How do i completely uninstall ELK?

I search on internet that we have to unistall each of the ELK part one by one like unistall stand-alone kibana, elastic search, and logstash. Is there any command which no need to unistall all of them ...
1
vote
0answers
869 views

logstash: Trying to extract substrings from path

I'm trying to extract substrings from my path field in my logstash config. The 'path' field looks like this: /storage/logs/deployment/servers/hostname.example.com/server.log Inside a filter section ...
2
votes
0answers
2k views

Rsyslog doesn't send logs to logstash server on port

I have two rsyslog-client and rsyslog-server. When I tried to "logger -p local1.notice SOMETHING" I don't see any information on server from one client, but from another I see logstash output. I have ...
0
votes
1answer
447 views

Kibana- Want to split vertical bars based on my log fields

I have an application log file consists of following log levels: INFO, WARN, ERROR, DEBUG. Following filter criteria works fine in logstash config file: filter { grok { match => { "...
0
votes
1answer
185 views

logstash - take 2 - filter to send messages from IntelMQ/python/redis to ELK

Following up on the heels of this question, https://stackoverflow.com/questions/40768603/logstash-trying-to-make-sense-of-strings-passed-by-intelmq-in-elasticsearch I am trying to create a refine/...
1
vote
1answer
688 views

geoip logstash filter not working in Debian

I am trying to setup the geoip filter for logstashin Debian Stretch, as per this question I installed the geoip-database package, however logstash logs complain of wrong database format. What to do?
1
vote
1answer
249 views

Tile/Greographic Map in Kibana not working

I am trying to create a geographical map of my data in Kibana 5.01, and it does not work. The fact is that I do not even have the geoip.field that is required in the menu. I am sending data from ...
1
vote
1answer
2k views

logstash regex match in if condition

In logstash filtering, I have multiple tags setup based upon different error conditions and all the tags has a prefix, something like "abc:" In the output, I want to send email based upon just "abc:*"...