Nginx – Logstash behind the proxy doesn’t work

haproxyload balancinglogstashnginxreverse-proxy

I'm trying to launch few Logstash instances behind the proxy.

I'm using nginx, but HAProxy is an option as well.

worker_processes 4;

events {
    worker_connections 1024;
}

http {
    upstream streams {
        server logstash_ip:5044;
    }

    server {
        listen 80;

        location / {
            rewrite ^/(.*) /$1 break;
            proxy_ignore_client_abort on;
            proxy_pass http://streams;
            proxy_set_header  X-Real-IP  $remote_addr;
            proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header  Host $http_host;
        }
    }
}

logstash_ip is an alias, it is resolvable.

The problem is that when I'm pushing some logs directly to the logstash – everything is ok.

When I'm pushing logs through the Nginx it fails:

  1. Navigating Nginx with port gives me 502 Gateway error

  2. Logstash logs

    Error publishing events (retrying): lumberjack protocol error

Best Answer

Error publishing events (retrying): lumberjack protocol error

Which is true, as the lumberjack protocol is not one based on http, which is what Nginx is expecting in your configuration. I suggest trying a stream { } block instead for nginx, as that's designed for TCP-protocols.

stream {
  server {
    listen 80
  }
  upstream stream_backend {
    server logstash_ip:5044
  }
}
Related Topic