GELF UDP plugin configuration

[Arthur]

Hi,

I have installed GELF UDP plugin with success in logstash, but 12201 is not open after restarting logstash. Do you know if it is needed additional configuration to start receiving logs from filebeat in graylog?

Currently, the configuration in ELK allows me to receive logs from filebeat, but I would receive the logs in Graylog.

My installation includes ELK 6.6.0, graylog 3.0.0 and mongodb 4.0.6

I have found that I needed to configure logstash.conf in addition:

    output {
      gelf {
        host => "graylog address"
        port => 12201
        short_message => "Testing gelf output"
      }
      stdout { codec => rubydebug }
    }

Thanks in advance

[jan (Jan Doberstein)]

You have seen this is the Graylog community and not the Elastic community in the logstash sub community?

[Arthur]

Yes, I asked because I was trying to get graylog running and I saw this configuration was related. Thanks for your help in this community.

[jan (Jan Doberstein)]

Maybe you should clarify what tool you have and what you try to accomplish.

You have installed a plugin to logstash and want logstash to listen on a specific port.
You want to send log files via filebeat to Graylog.

Your wanted processing is not clear communicated.