Questions tagged [logstash]
Logstash collects data from many types of logs, filters it, and outputs the result using many plugins. It is often associated with Elasticsearch and Kibana which have their own tags.
22
questions
0
votes
1
answer
2k
views
keytool error: java.io.IOException: Invalid keystore format
I have a 3-node ELK stack (Elasticsearch v7.17). After a reboot, the Kibana web interface reports an error "Kibana server is not ready yet".
The SSL certs were expired, so I re-created them (...
- 28.8k
0
votes
0
answers
585
views
Unable to send logs from rsyslog to logstash and elasticsearch
I am using ubuntu and I installed the ELK stack version 8.5 on the same machine. I did the necessary configurations for each of the services(logstash, elasticsearch, kibana) and I equally configured ...
1
vote
1
answer
379
views
How to make bash script invoking logstash return prompt
For various reasons, I am not running logstash (7.10.1) as a service, but rather invoking it on-demand, in a bash script:
/usr/share/logstash/bin/logstash -f /etc/logstash/conf.d/my_ls.conf &
echo ...
- 193
0
votes
1
answer
3k
views
how to enable debug logs in stdout for logstash?
I'm struggling as newbie in logstash, below is some info of my env
Logstash Version: logstash-7.16.2-1.x86_64
java Version: openjdk version "11.0.13" 2021-10-19 LTS
Logstash Conf
input {
...
- 1,889
0
votes
1
answer
439
views
prevent inode reuse
We are using Logstash to ingest our logs and we are facing some issues due inodes being reused. We tried all possible options on Logstash side so we are exploring the OS side.
As far as I can see, if ...
- 3
1
vote
0
answers
231
views
Nginx in UDP load balancing continue to send to an unreachable upstream server
I use Nginx to load balance traffic coming from udp syslog sources to logstash
Configuration :
user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log;
pid /run/nginx.pid;
...
- 11
0
votes
0
answers
199
views
How to monitor a directory for changes across reboots?
I'm searching for a tool that will allow me to run a program for every change in a directory, but is guaranteed to run exactly once per change even across system reboots. For the purposes of this ...
- 101
0
votes
0
answers
95
views
hearthbeat can't run
I have ELK server, and sending Heartbeats to server. I added an monitor in monitors.d directory, added setup.dashboards.enabled: true line in heartbeat.yml file, but after restarting heartbeat service,...
- 105
2
votes
1
answer
9k
views
what is GREEDYDATA in elasticsearch
reading the conf files of logstash i found in filter conf
grok {
match => { "message" => "Put\s*command\s*:\s+%{GREEDYDATA:command}" }
}
How does this filter work , i tried to ...
- 43
1
vote
1
answer
376
views
rsyslog error in logstash
I have installed ELK and tried to configure rsyslog server with logstash but i am getting lot of \ while executing curl -XGET 'http://172.22.63.61:9200/logstash-*/_search?q=*&pretty'
Rsyslog ...
- 11
0
votes
1
answer
77
views
Logstash output to nginx
I have 3 node and run cluster graylog-server.
I use nginx for load balancer and on nginx open port (12301).
i want to send log JSON format from logstash to this nginx then nginx, load balancer and ...
- 619
1
vote
1
answer
658
views
Logstash Unrecognized service Amazon Linux
I have been following this tutorial to install ELK stack in a remote server which runs on Amazon Linux.
https://www.aytech.ca/blog/setup-elk-stack-amazon-linux/
I was able to install Elasticsearch and ...
- 115
0
votes
1
answer
840
views
problem re-loading index from filebeat in elasticsearch
I am using the ELK stack (more ELG stack as I am using Grafana as the front end instead of kibana for personal reasons). I am using Filebeat to send the logs file to Logstash which are then stored in ...
0
votes
2
answers
664
views
How to configure Simple Event Correlator (SEC) to send info about mail delivery failure
My log file contains the following 3 log entries:
2017-11-16 15:50:45 1eFLV7-0003so-Cd <= <> R=1eFLV7-0003sZ-4v U=Debian-exim P=local S=1853 T="Mail delivery failed: returning message to ...
- 237
-1
votes
2
answers
29k
views
How do i completely uninstall ELK (Elasticsearch, Logstash, Kibana)?
I search on internet that we have to unistall each of the ELK part one by one like unistall stand-alone kibana, elastic search, and logstash. Is there any command which no need to unistall all of them ...
- 225
1
vote
0
answers
1k
views
logstash: Trying to extract substrings from path
I'm trying to extract substrings from my path field in my logstash config.
The 'path' field looks like this:
/storage/logs/deployment/servers/hostname.example.com/server.log
Inside a filter section ...
- 1,950
2
votes
0
answers
2k
views
Rsyslog doesn't send logs to logstash server on port
I have two rsyslog-client and rsyslog-server. When I tried to "logger -p local1.notice SOMETHING" I don't see any information on server from one client, but from another I see logstash output.
I have ...
- 177
0
votes
1
answer
513
views
Kibana- Want to split vertical bars based on my log fields
I have an application log file consists of following log levels: INFO, WARN, ERROR, DEBUG. Following filter criteria works fine in logstash config file:
filter {
grok {
match => { "...
- 335
1
vote
1
answer
234
views
logstash - take 2 - filter to send messages from IntelMQ/python/redis to ELK
Following up on the heels of this question, https://stackoverflow.com/questions/40768603/logstash-trying-to-make-sense-of-strings-passed-by-intelmq-in-elasticsearch I am trying to create a refine/...
- 56k
1
vote
1
answer
785
views
geoip logstash filter not working in Debian
I am trying to setup the geoip filter for logstashin Debian Stretch, as per this question
I installed the geoip-database package, however logstash logs complain of wrong database format. What to do?
- 56k
2
votes
1
answer
261
views
Tile/Greographic Map in Kibana not working
I am trying to create a geographical map of my data in Kibana 5.01, and it does not work. The fact is that I do not even have the geoip.field that is required in the menu.
I am sending data from ...
- 56k
1
vote
2
answers
4k
views
logstash regex match in if condition
In logstash filtering, I have multiple tags setup based upon different error conditions and all the tags has a prefix, something like "abc:"
In the output, I want to send email based upon just "abc:*"...
- 61