trying to send the logs from nxlog to fluentd via tcp

Graylog Central (peer support)
1

Hi All,

I am trying to send the logs from nxlog present on server1 to fluentd present on server2.

The log file looks like below:

2018-03-20 11:47:58.777554
2018-03-20 11:47:58.780092
2018-03-20 11:48:13.826746
2018-03-20 11:48:13.827341
2018-03-20 11:48:14.144523
2018-03-20 11:48:14.144947
2018-03-22 12:43:18.175988

The nxlog conf file looks like below:

<Input in10>
    Module      im_file
    File        "/var/log/nxlog/detail_test1"
</Input>

<Output tcp10>
    Module      om_tcp
    Host        <IP address of server2>
    Port        5171
</Output>

<Route test10>
    Path        in10 => tcp10
</Route>

The conf file for the fluentd looks like below:

<source>
  @type tcp
  tag tcp.events # required
  format /^(?<timestamp2>\w+)$/
  port 5171
  bind 0.0.0.0
  delimiter \n
</source>

<match tcp.events>
  @type stdout
</match>

The fluentd logs looks like below:

2018-03-22 12:47:11 +0000 [info]: listening tcp socket on 0.0.0.0:5171
2018-03-22 12:47:11 +0000 [info]: listening fluent socket on 0.0.0.0:24224
2018-03-22 12:47:11 +0000 [info]: listening dRuby uri="druby://127.0.0.1:24230" object="Engine"

The nxlog.log file states the below error:

2018-03-22 12:47:10 INFO reconnecting in 1 seconds
2018-03-22 12:47:10 ERROR om_tcp detected a connection error;Connection reset by peer
2018-03-22 12:47:10 INFO reconnecting in 2 seconds
2018-03-22 12:47:11 INFO connecting to <IP address>:5171
2018-03-22 12:47:11 INFO reconnecting in 4 seconds
2018-03-22 12:47:11 ERROR couldn't connect to tcp socket on <IP address>:5171;Connection refused
2018-03-22 12:47:12 INFO connecting to <IP address>:5171
2018-03-22 12:47:33 INFO reconnecting in 1 seconds

Could you please help? Why there is a connection error. There is no firewall rule, it seems.

2

This is not exactly a question about Graylog, isn’t it?

3

This is more about nxlog and fluentd. if you know what is wrong in the conf file? Could you please suggest the solution.

4

I’d suggest asking these questions in the NXLOG and fluentd communities:

5

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.