Hi, I need to setup a POC where I send Logs from 100+ filebeats to a Graylog instance, but the Graylog instance and Elasticsearch is in our HQ (not China) and the 100+ Clients are in China. So my plan was to put an Aggregator on the China side which is logstash. Logstash should collect all filebea…

Logstash Lumberjack Output to BEATS Input Graylog should work flawless. The Forwarder is Graylog Enterprise, yes (that is why I connected you to sales) and will be Graylog Forwarder Output > Graylog Forwarder Input.

the “beats” output in logstash is called lumberjack - because that is the origin of the beats protocol You might want to contact Sales ( http://graylog.org/contact-sales ) as we have something short before release that is build exactly for that. We call it Forwarder

Hi Jan, thanks, so you say i can use the lumberjack output to utilize the beats input? Thanks, but I have some questions then: Will this be a enterprise feature? Will the forwarder support outputs to graylog and Elasticsearch directly? Will the forwarder be able to do something like beats -> for…

Thanks I need a Forwarder that is capable of doing multiple protocolls IN and OUT, so i will try the lumberjack way for now, and will see how the Graylog Forwarder is developing, maybe its a better option in the future then. Thank you for the help! :+1:

The Forwarder is a plugin to a full Graylog - so in your setup you would have one Graylog with all options in China, in that a forwarder output that includes journal (if the connection to the central is not available) and in your central the forwarder input on your Central Graylog.

Hey Jan, i’ve tried the lumberjack output to beats input, but it doesnt get a connection. IDK where my problem is, i get this messages on graylog: 2019-04-01T11:28:00.230+02:00 ERROR [AbstractTcpTransport] Error in Input [Beats/5c6acc71a0303c17f682ba78] (channel [id: 0xa2af5fea, L:/172.21.2.63:50…

@jan is this related? https://github.com/logstash-plugins/logstash-output-lumberjack/issues/27 Is the beats input only capable of lumberjack V2?

Ok Thanks, but do you have a config for the lumberjack output to beats input that worked or is working? I ask, because you told me in this thread, that it should work. So maybe I get the push into the right direction with a working config. Thanks for your time.

Filebeat -> Logstash -> Graylog (all SSL secured)

Graylog Central (peer support)

jan (Jan Doberstein) April 1, 2019, 11:12am 9

to be honest - I do not know.

Sorry didn’t have the time to create a POC for that and check.

Big infrastructure with Graylog

Topic		Replies	Views
Adding Graylog to already existing ELK stack Graylog Central (peer support)	5	5646	March 26, 2018
Beats Input messages not showing in Graylog Graylog Central (peer support)	1	1272	July 20, 2022
Not receiving all logs in Graylog Graylog Central (peer support) sidecar , filebeat-linux , nosendlogfblx , clfblx	6	4671	March 22, 2019
Metricbeats Communication Issue to Graylog Graylog Central (peer support)	8	2563	May 16, 2018
Ingesting Log Files from JSON into graylog Graylog Central (peer support)	12	4896	August 17, 2022

Filebeat -> Logstash -> Graylog (all SSL secured)

Related topics