Hello,
- This is my configuration:
On graylog I have 2 Inputs, one for all Linux servers, and one for all Windows servers:
On Logstash, I have 2 configurations file (one for linux (syslog) and one for windows (beat))
[root@ELK conf.d]# cat syslog.conf
input {
tcp {
port => 1514
type => syslog
}
udp {
port => 1514
type => syslog
}
}
output {
gelf {
host => "192.168.1.206"
port => 10000
}
}
and
[root@ELK conf.d]# cat beat.conf
input {
beats {
port => 5000
#codec => "json"
}
}
output {
gelf {
host => "192.168.1.206"
port => 12201
}
}
- On Linux server I have: (rsyslog.conf)
*.* @@192.168.1.210:1514
-
On Windows server I have: (winlogbeat.yml)
winlogbeat: registry_file: C:/ProgramData/winlogbeat/.winlogbeat.yml event_logs: - name: Application - name: Security - name: System #----------------------------- Logstash output -------------------------------- output.logstash: hosts: ["192.168.1.210:5000"] logging: to_files: true files: path: C:/ProgramData/winlogbeat/Logs level: info
-
And that works good BUT, I receive the logs go on the TWO Graylog’s inputs!!
-
On a Linux server, If I do “logger TEST LOGSTASH”, I have the same log x 2, One by Graylog’s Input!
)
How Can I fix that?
Thank you for reading