[ELK] Syslog 监控

一、定义客户端rsyslog配置文件
# vi/etc/rsyslog.conf
*.* @@192.168.1.75:514           #将所有syslog日志发送至
192.168.1.75 的514端口
# :wq
 # systemctl restart rsyslog
 
二、192.168.1.75的logstash配置
input {
    syslog {
        type => "system-syslog"
        host => "192.168.1.75"
        port => "514"
    }
}
output {
       
    if [type] == "system-syslog" {
        elasticsearch {
            hosts =>["192.168.1.75:9200"]
            index =>"syslog-%{+YYYY.MM.dd}"
        }
    }
    
}