Data ingestion with Logstash
In the last example, we used Logstash to ingest log data from network devices. Let's build on that example and add a few more configuration changes in network_config/config_2.cfg:
input {
udp {
port => 5144
type => "syslog-core"
}
udp {
port => 5145
type => "syslog-edge"
}
}
filter {
if [type] == "syslog-edge" {
grok {
match => { "message" => ".*" }
add_field => [ "received_at", "%{@timestamp}" ]
}
}
}
<skip>
In the input section, we will listen on two UDP ports, 5144 and 5145. When the logs are received, we will tag the log entries with either syslog-core or syslog-edge. We will also add a filter section to the configuration to specifically match the syslog-edge type and apply a regular expression section, Grok, for the message...