I am trying to use logstash TCP output in order to send the log messages to graylog via Raw/Plaintext TCP input. But unable to see the log messages on graylog UI even though I can observe the incoming traffic to my input.
Please help in finding the issue with “Raw/Plaintext TCP input” or any link how to use “Raw/Plaintext TCP input” will also help us in order to follow that.
Logstash config file that is used to forward the log is as below,
input {
file {
type => app
path => ["/var/log/test.log"]
}
}
output {
tcp {
host => "<graylog_hostname>"
port => <graylog input port number>
}
}
Log messages are reaching graylog input and can be seen in Throughput / Metrics corresponding to input on graylog console. But messages are not populating on graylog dashboard.
@jochen Thanks for continuous support in order to solve my problem. My issue is fixed.
Issue was from logstash side, where Logstash TCP output was sending log messages in lines so it graylog was unable to handle the messages. So added codec => json_lines in logstash config file and it is working as expected,