Send json log via logstash to nginx and graylog

Graylog Central (peer support)
1

i have log with json format, I want send this log by logstash to nginx (my loadbalancer), so i use http plugin for logstash. my nginx config is:

[root@loadbalancer conf.d]# cat graylog.conf
upstream graylog_input {
    server 172.16.70.197:12303;
    server 172.16.70.198:12303;
    server 172.16.70.199:12303;
}

server {
  listen 12303;
   location / {
     proxy_set_header  Host $http_host;
     proxy_set_header  X-Forwarded-Host $host;
     proxy_set_header  X-Forwarded-Server $host;
     proxy_set_header  X-Real-IP $remote_addr;
     proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
     proxy_pass        http://graylog_input;
  }
}

my logstash config is:
input {
tcp {
port => “2234”
codec => json_lines
host => localhost
}
}
output {
http {
http_compression => true
codec => “json”
url => “http://172.16.70.98:12303”
http_method => “post”
}
}

I check three input in graylog (Raw/Plaintext TCP, GELF TCP, GELF HTTP) but all input is not correct.
What input should I use? Where is the wrong thing??

2

you have a logfile that is json and want to ship that to Graylog?

use filebeat to read the logfile and ingest that into a beats input of Graylog.

3

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.