CentOS 7 Rsyslog And ELK

Home » General » CentOS 7 Rsyslog And ELK
General 5 Comments

I asked a similar question about a year ago and didn’t get any answers. So I thought I’d try again.

What do people do to get their syslog messages on CentOS 7 into a remote ELK stack. I’ve tried lots of things involving rsyslog, filebeat, redis, logstash and so on in lots of different configurations but nothing really works.

I can get rsyslog to talk directly to logstash (acting as a syslog server) but the messages don’t have facility or severity codes in them which makes it considerably more difficult to manage the messages.

P.

5 thoughts on - CentOS 7 Rsyslog And ELK

  • Honestly, as much as I have heard of people using Elastic Kibana.. they are usually using it for things already in JSON. WHen I looked in the past I either found someone wanting me to set up a 20 node cluster to monitor logs or someone sayin they had but nothing in it. I was going to say I didn’t know but decided to look again and I found this article https://devconnected.com/monitoring-linux-logs-with-kibana-and-rsyslog/

    The section “b – Routing from rsyslog to Logstash” of the article seems to cover a filter that needs to be added. You may have already tried this.. but that is about all i can help with currently.

    —
    Stephen J Smoogen.

  • Thanks. Yes, I was trying to get rsyslog to send JSON to logstash and I have tried that template. A bit more investigation though and it turns out that the firewall on the logstash server was only letting through tcp packets and it needs udp. Now I’ve fixed that, they appear to be talking to each other, but it certainly doesn’t seem to be logging everything.

    Progress of sorts!

    P.

  • Thanks. The problem is getting that into logstash. But it’s actually quite useful anyway as it’s another method of monitoring what is supposed to be logged.

    P.