I want my local instance of Logstash to forward syslog and all /var/log/*
files to a remote, central instance of Logstash.
The pipeline in /etc/logstash/conf/logstash-local.conf
looks as follows:
input {
file {
type => "syslog"
path => [ "/var/log/*.log", "/var/log/syslog" ]
}
}
output {
stdout { codec => rubydebug }
tcp {
host => "logging.example.com"
port => 5000
}
}
When I try and execute logger "foo"
, the event is logged to the local syslog, but it is not found in my remote Logstash. Neither are other events from syslog.
Things I tried:
- The local Logstash reports in its log file that the pipeline is running correctly
- I connected with telnet to the remote server, and verified direct input is correctly processed
- Permissions were locally changed to grant user Logstash membership in the adm group
Everything looks perfect... but it does not work! :)