Question

I have just put up an ELK stack, but I am having trouble regarding the logstash configuration in /etc/logstash/conf.d I have two input sources being forwarded from one linux server, which has a logstash forwarder installed on it with the "files" looking like:

{
      "paths": ["/var/log/syslog","/var/log/auth.log"],
      "fields": { "type": "syslog" }
    },
    { 
      "paths": ["/var/log/osquery/osqueryd.results.log"],
      "fields": { "type": "osquery_json" } 
}

As you can see, one input is an osquery output (json formatted), and the other is syslog. My current config for logstash is osquery.conf:

input {
  lumberjack {
    port => 5003
    ssl_certificate => "/etc/pki/tls/certs/logstash-forwarder.crt"
    ssl_key => "/etc/pki/tls/private/logstash-forwarder.key"
    codec => "json"
  }
}

filter {
   if [type] == "osquery_json" {
      date {
        match => [ "unixTime", "UNIX" ]
      }
   }
}

output {
  elasticsearch { host => localhost }
  stdout { codec => rubydebug }
}

Which works fine for the one input source, but I do not know how to add my other syslog input source to the same config, as the "codec" field is in the input -- I can't change it to syslog...

I am also planning on adding another input source in a windows log format that is not being forwarded by a logstash forwarder. Is there anyway to structure this differently?

Answer 1

如果要在同一输入上处理不同的编解码器，最好从输入中删除编解码器：

input {
  lumberjack {
    port => 5003
    ssl_certificate => "/etc/pki/tls/certs/logstash-forwarder.crt"
    ssl_key => "/etc/pki/tls/private/logstash-forwarder.key"
  }
}

filter {
   if [type] == "osquery_json" {
      json {
        source => "field_name_the_json_encoded_data_is_stored_in"
      }
      date {
        match => [ "unixTime", "UNIX" ]
      }
   }
   if [type] == "syslog" {

   }
}

output {
  elasticsearch { host => localhost }
  stdout { codec => rubydebug }
}

然后你只需要决定你想用syslog消息做什么。

我建议将配置分成多个文件。我倾向于使用01-filename.conf - 10-filename.conf作为输入，11-29作为过滤器以及任何高于输出的东西。这些文件将按照以ls。

打印的顺序加载到logstash中

Possible to specify two different codecs in lumberjack?

1 个答案: