Sending logs via Syslog

(Salma Ait Lhaj) #1


I want to receive logs on my Graylog, this logs come from Syslog, but Graylog and Syslog are not on the same server,

How can I do this please ?

I read this, but I still don’t know :confused:

(Jan Doberstein) #2

you need to create a syslog input on Graylog and then configure your syslog to forward the messages to the previous created input.

(Salma Ait Lhaj) #3

Can you show me please how can I create a input Syslog ?

In my previous test on ELK I used Filebeat to push logs into my server, can I use it also with Graylog ?

(Jochen) #4

You create inputs in the Graylog web interface on the System (menu bar on top) / Inputs page.

Yes, you can also use any Beat (such as Filebeat) with Graylog. You only need to create a Beats input (on the System/Inputs page) and use Filebeat’s “logstash” protocol to send messages to Graylog.

(Salma Ait Lhaj) #5

But when I do a netsat, I can’t find the port 514 ?

(Jochen) #6

That’s because the input is not running and because port 514/udp is a privileged port.

See for more details.

(Salma Ait Lhaj) #7

Is this line correcte ?

elasticsearch_hosts = http://network-

(network-2 = name of the node)

(Jochen) #8

No, either use the IP address of the Elasticsearch node or its hostname. The Elasticsearch node name has nothing to do with it.

(Salma Ait Lhaj) #9

Is it important that the name of the cluster is graylog ?

Can you help resolve this ?

[root@frghcslnetv12 server]# curl -X GET http://localhost:9200
curl: (7) Failed connect to localhost:9200; Connection refused

(Jochen) #10

No, that’s not required since Graylog 2.3.0.

That’s just to make sure that you don’t accidentally write into a “test” Elasticsearch cluster which might exist in your network.

Check the logs of your Elasticsearch node(s) and make sure that the service is running.

(Salma Ait Lhaj) #11
[root@frghcslnetv12 ~]# systemctl status elasticsearch.service
● elasticsearch.service - Elasticsearch
   Loaded: loaded (/usr/lib/systemd/system/elasticsearch.service; enabled; vendor preset: disabled)
   Active: failed (Result: exit-code) since Wed 2018-06-13 11:53:44 CEST; 10s ago
  Process: 24501 ExecStart=/usr/share/elasticsearch/bin/elasticsearch -p ${PID_DIR}/ --quiet (code=exited, status=1/FAILURE)
 Main PID: 24501 (code=exited, status=1/FAILURE)

Jun 13 11:53:42 frghcslnetv12 systemd[1]: Started Elasticsearch.
Jun 13 11:53:42 frghcslnetv12 systemd[1]: Starting Elasticsearch...
Jun 13 11:53:44 frghcslnetv12 systemd[1]: elasticsearch.service: main process exited, code=exited, status=1/FAILURE
Jun 13 11:53:44 frghcslnetv12 systemd[1]: Unit elasticsearch.service entered failed state.
Jun 13 11:53:44 frghcslnetv12 systemd[1]: elasticsearch.service failed.

I don’t know why it doesn’t want to start

(Jochen) #12

Check the logs of that Elasticsearch node.

(Salma Ait Lhaj) #13
[root@frghcslnetv12 elasticsearch]# df -k
Filesystem                1K-blocks     Used Available Use% Mounted on
/dev/mapper/vgroot-root    22132164  6197168  15934996  29% /
devtmpfs                    3980968        0   3980968   0% /dev
tmpfs                       3997156        0   3997156   0% /dev/shm
tmpfs                       3997156    12220   3984936   1% /run
tmpfs                       3997156        0   3997156   0% /sys/fs/cgroup
/dev/sda1                   1038336   212980    825356  21% /boot
/dev/mapper/vgdata-lvdata  50442784 47857392         0 100% /data
tmpfs                        799432        0    799432   0% /run/user/0

My data base is full , I use curator in the other node but it doesnt clear this node, can you help me ?

(Jochen) #14

Well, you either have to provide more disk space to the “lvdata” logical volume and increase the /data partition, or free some disk space from the /data partition.

(system) closed #15

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.