logstash收集rsyslog日志
(1)rsyslog配置
在192.168.1.31配置
#vim /etc/rsyslog.conf
*.* @@192.168.1.32:514 //所有设备名,所有日志级别都发送到192.168.1.32的rsyslog
#systemctl restart rsyslog
(2)测试rsyslog标准输入输出
1.在192.168.1.32测试rsyslog接收
#vim /etc/logstash/conf.d/rsyslog.conf
input {
syslog {
type => "system-syslog"
port => 514
}
}
output {
stdout {
codec => rubydebug
}
}
2.检测配置文件
#logstash -f /etc/logstash/conf.d/rsyslog.conf -t
#logstash -f /etc/logstash/conf.d/rsyslog.conf
3.在192.168.1.31上发送日志
logger -p local5.info "ppp"
4.验证
(3)配置logstash将rsyslog日志输出到elasticsearch
1.192.168.1.32上配置
#vim /etc/logstash/conf.d/rsyslog.conf
input {
syslog {
type => "system-syslog"
port => 514
}
}
output {
elasticsearch {
hosts => ["192.168.1.31:9200"]
index => "system-syslog-%{+YYYY.MM}"
}
}
杀logstash进程,重启启动
2.在192.168.1.31上产生rsyslog日志
logger -p local5.info "ppppppp"
3.head插件验证
4.kibana添加索引