Logstash with journald instead of rsyslog

journaldlogstashrsyslog

I'm used to sending my logs from a server to a remote Logstash using rsyslog, with a configuration file roughly as follows (usually more specific to prevent too many logs from being sent):

*.* @192.168.5.5:5000

I'm now starting work on a server that does not have syslog running but instead uses journald. Is there a similar way to send the logs to Logstash with journald as is done with Syslog, or does it require more work? I can't find much information online regarding the use of Logstash with journald.

Best Answer

There is no official support, but there is an open issue to get it added. It turns out there are a few plugins that shim in this support, notably logstash-input-journald.

Related Solutions

Ssl – rsyslog starttls ssl

According to rsyslog'd documentation the gtls driver supports EITHER unencrypted transmission just like the ptcp driver does with InputTCPServerStreamDriverMode set to 0, or TLS mode with it set to 1.

It also states:

Note: mode 0 does not provide any benefit over the ptcp driver. This mode exists for technical reasons, but should not be used. It may be removed in the future.

Thus it appears you have to choose encrypted or not encrypted, at least for a particular IP address+port combination. So you will have to setup two ports, one using the ptcp driver, and one with the gtls driver. Or if every system you have logging supports encryption, only use encrypted syslog connections.

Logstash shipper & server on the samebox

I'm not sure if I understood the question correctly, but I do know that Syslog-NG can ship directly to Logstash without the need for an additional shipper as an intermediary. You could define a destination in syslog-ng.conf similar to this example:

destination d_logstash { 
  tcp("10.0.0.1" port(5514)); 
};

And then define a log action to send Syslog messages from source s_src to destination:

log {
  source(s_src);
  destination(d_logstash);
};

Which should enable the message transmission. Don't forget to restart the syslog-ng service to apply the changes.

source: The Logstash Book

Best Answer

Related Solutions

Ssl – rsyslog starttls ssl

Logstash shipper & server on the samebox

Related Topic