Ingest apache error_logs into graylog

Graylog Central (peer support)
1

Hello,

I am new to Graylog and im trying to understand some points in order to configure properly Graylog with Filebeat as an input by sending Apache error_logs.
So here is my setup :

Server1 : Graylog ( elasticsearch/mongo/graylog) services

Client1 : Apache service + Filebeat

I’ve already read some articles like this one : https://www.elastic.co/guide/en/beats/filebeat/6.3/filebeat-getting-started.html and several graylog threads ,but still is not clear to me how Im going to setup it correctly.

I know that Filebeat should send the input first to Logstash ,because doesnt support data over UDP ,so in Server1 should i setup additionaly Logstash ?
Also , what is the recommended logstash or filebeat configuration in such caces ?

Any help would be appreciated.

2

no, you run filebeat on the client and create on the Graylog server a beats input. The filebeat configuration then need to be pointed to the beats input as output.

You might find this page helpfule.

http://docs.graylog.org/en/2.4/pages/secure/sec_graylog_beats.html#secured-graylog-and-beats-input

3

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.