Split logwatch outpup for Graylog

Hello,

  • This is my configuration:

On graylog I have 2 Inputs, one for all Linux servers, and one for all Windows servers:

On Logstash, I have 2 configurations file (one for linux (syslog) and one for windows (beat))

[root@ELK conf.d]# cat syslog.conf
        input {
           tcp {
            port => 1514
            type => syslog
          }
          udp {
            port => 1514
            type => syslog
          }
         }
        output {
            gelf {
              host => "192.168.1.206"
              port => 10000
           }
          }

and

[root@ELK conf.d]# cat beat.conf
input {
  beats {
    port => 5000
#codec => "json"
  }
 }
 output {
  gelf {
  host => "192.168.1.206"
  port => 12201
  }
 }
  • On Linux server I have: (rsyslog.conf)

*.* @@192.168.1.210:1514

  • On Windows server I have: (winlogbeat.yml)

      winlogbeat:
            registry_file: C:/ProgramData/winlogbeat/.winlogbeat.yml
    
        event_logs:
          - name: Application
          - name: Security
          - name: System
    
      #----------------------------- Logstash output --------------------------------
      output.logstash:
    
        hosts: ["192.168.1.210:5000"]
    
      logging:
        to_files: true
        files:
          path: C:/ProgramData/winlogbeat/Logs
        level: info
    
  • And that works good BUT, I receive the logs go on the TWO Graylog’s inputs!!

  • On a Linux server, If I do “logger TEST LOGSTASH”, I have the same log x 2, One by Graylog’s Input!

log )

How Can I fix that?

Thank you for reading

if you expand the message you see in what indices that message is stored and what input received the message - this way you can debug what happens.

edit: I’m not a Logstash pro - but as you do not have any tags in your configuration the messages will be send to all outputs that are configured. So you seng the message twice from logstash. Change the configuration to include tags and it should work.

1 Like

Hello,

That works:

For the Linux logs:

input {
  tcp {
    port => 1514
    type => syslog
 tags => ["linux"] # <--------tag

  }

  udp {
    port => 1514
    type => syslog
    tags => ["linux"] # <--------tag
  }

}

 output {
   if "linux" in [tags] { # <--------tag
  gelf {
  host => "192.168.1.206"
  port => 10000
  }
 }
}

And for windows:

input {
  beats {
    port => 5000
    tags => ["windows"]  # <--------tag

  }
 }

output {
  if "windows" in [tags] {  # <--------tag
  gelf {
  host => "192.168.1.206"
  port => 12201
  }
 }
}

Thank you.

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.