Configure RSyslog to Export to Elasticsearch
$ vi /etc/rsyslog.conf
# /etc/rsyslog.conf Configuration file for rsyslog. # # For more information see # /usr/share/doc/rsyslog-doc/html/rsyslog_conf.html # # Default logging rules can be found in /etc/rsyslog.d/50-default.conf ################# #### MODULES #### ################# module(load="imuxsock") # provides support for local system logging module(load="imklog") # provides kernel logging support #module(load="immark") # provides --MARK-- message capability # provides UDP syslog reception module(load="imudp") input(type="imudp" port="514") # provides TCP syslog reception module(load="imtcp") input(type="imtcp" port="514") # Enable non-kernel facility klog messages $KLogPermitNonKernelFacility on ########################### #### GLOBAL DIRECTIVES #### ########################### # # Use traditional timestamp format. # To enable high precision timestamps, comment out the following line. # $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat # Filter duplicated messages $RepeatedMsgReduction on # # Set the default permissions for all log files. # $FileOwner syslog $FileGroup adm $FileCreateMode 0640 $DirCreateMode 0755 $Umask 0022 $PrivDropToUser syslog $PrivDropToGroup syslog # # Where to place spool and state files # $WorkDirectory /var/spool/rsyslog # # Include all config files in /etc/rsyslog.d/ # #$IncludeConfig /etc/rsyslog.d/*.conf *.* /var/log/messages
Restart Rsyslog
$ service rsyslog restart
Test
tail -f /var/log/messages
From another command prompt
logger "hi"
Utilities
Send logs to Syslog
$ logger -n localhost 'log message from host'
References
| Reference | URL |
|---|---|
| omelasticsearch: Elasticsearch Output Module | https://www.rsyslog.com/doc/v8-stable/configuration/modules/omelasticsearch.html |