配置檔案：/etc/logstash/conf.d/logstash-indexer.conf

input {
    #file {
    #    path => [ "/var/log/*.log", "/var/log/messages", "/var/log/syslog" ]
    #    type => "syslog"
    #}
    #redis {
    #    host => "192.168.10.1"
    #    type => "redis-input"
    #    data_type => "list"
    #    key => "logstash"
    #} 
    tcp {
        port => "1514"
        type => "syslog"
    }
    udp {
        port => "1514"
        type => "syslog"
    }
}

output {
    elasticsearch { hosts => ["localhost:9200"] }
}
 

客戶端rsyslog配置

編輯/etc/rsyslog.conf檔案，最後面新增以下行：

.* @@192.168.22.205:1514

重啟rsyslog：

service rsyslog restart

測試：

logger -p info "hello, rsyslog"

檢視kibana是否有相關日誌。