I configured logstash forwarder and try to parse the log files.Hope I did all the steps correctly by referring logstash book.While running the logstash configuration file and logstash forwarder I'm not seeing any error, but the file parsing is not starting.
Here are my configuration details
1. cat /etc/logstash/central.conf
input {
lumberjack {
port => 6782
ssl_certificate => "/etc/logstash/server.crt"
ssl_key => "/etc/logstash/server.key"
type => "lumberjack"
}
}
output {
stdout { codec => rubydebug }
}
2. cat logstash-forwarder.conf
{
"network": {
"servers": [ "54.227.XXX.XXX:6782" ],
"ssl ca": "/etc/logstash-forwarder/server.crt",
"ssl key": "/etc/logstash-forwarder/server.key",
"timeout": 15`enter code here`
},
"files": [
{
"paths": [
"/opt/logs/L/*.log"
]
Output for logstash
sudo bin/logstash -f /etc/logstash/central.conf Using milestone 1 input plugin 'lumberjack'. This plugin should work, but would benefit from use by folks like you. Please let us know if you find bugs or have suggestions on how to improve this plugin. For more information on plugin milestones, see http://logstash.net/docs/1.4.2/plugin-milestones {:level=>:warn}
Output for Logstash-forwarder
ubuntu@ip-10-231-15-32:~$ /opt/lumberjack/bin/lumberjack -config /etc/logstash-forwarder/logstash-forwarder.conf
-fro m-beginning=true
2015/01/13 12:55:09 publisher init
2015/01/13 12:55:09 {
"network": {
"servers": [ "54.227.XXX.XXX:6782" ],
"ssl ca": "/etc/logstash-forwarder/server.crt",
"ssl key": "/etc/logstash-forwarder/server.key",
"timeout": 15
},
"files": [
{
"paths": [
"/opt/logs/L/*.log"
]
}
]
}
2015/01/13 12:55:09.498742 Setting trusted CA from file: /etc/logstash-forwarder/server.crt
2015/01/13 12:55:09.499091 Connecting to 54.227.XXX.XXX:6782
2015/01/13 12:55:09.566860 Connected to 54.227.XXX.XXX:6782
Any Suggestions?
logstash-forwarder should log files it has found before network connection. Please recheck file and directory permissions that user running logstash-forwarder can do
ls /opt/logs/L/*.log
and
cat /opt/logs/L/*.log