Data Ingestion with Logstash
In the last example, we used Logstash to ingest log data from network devices. Let's build on that example and add a few more configuration changes in network_config/config_2.cfg:
input {
udp {
port => 5144
type => "syslog-core"
}
udp {
port => 5145
type => "syslog-edge"
}
}
filter {
if [type] == "syslog-edge" {
grok {
match => { "message" => ".*" }
add_field => [ "received_at", "%{@timestamp}" ]
}
}
}
output {
stdout { codec => json }
elasticsearch {
hosts => ["https://192.168.2.126:9200"]
<skip>
}
}In the input section, we will listen on two UDP ports, 5144 and 5145. When the logs are received, we will tag the log entries with either syslog-core or syslog-edge. We will also add a filter section to the configuration to specifically...