We did E from the ELK stack. Now let's move to L. LogStash requires a configuration file. We'll use one that is already available inside the vfarcic/cloud-provisioning (https://github.com/vfarcic/cloud-provisioning) repository. We’ll create a new directory, copy the conf/logstash.conf (https://github.com/vfarcic/cloud-provisioning/blob/master/conf/logstash.conf) configuration, and use it inside the logstash service:
mkdir -p docker/logstash
cp conf/logstash.conf \
docker/logstash/logstash.conf
cat docker/logstash/logstash.confThe content of the logstash.conf file is as follows:
input {
syslog { port => 51415 }
}
output {
elasticsearch {
hosts => ["elasticsearch:9200"]
}
# Remove in production
stdout {
codec => rubydebug
}
}This is a very simple LogStash configuration. If will listen on port 51415 for syslog entries.
Each entry will be sent to two outputs; elasticsearch and stdout. Since both logstash and...