[ELK] Syslog 监控

一、定义客户端rsyslog配置文件

# vi/etc/rsyslog.conf

*.* @@192.168.1.75:514           #将所有syslog日志发送至 192.168.1.75 的514端口

# :wq

 # systemctl restart rsyslog

 

二、192.168.1.75的logstash配置

input {

    syslog {

        type => "system-syslog"

        host => "192.168.1.75"

        port => "514"

    }

}

output {

       

    if [type] == "system-syslog" {

        elasticsearch {

            hosts =>["192.168.1.75:9200"]

            index =>"syslog-%{+YYYY.MM.dd}"

        }

    }

    

}