logstash配置syslog外发

需求：logstash收到的syslog日志发往elasticsearch和深信服日志审计设备。

本以为直接写outside就可以解决问题，启动时报错，logstash默认情况下未安装logstash-output-syslog组件，需先安装此组件才能正确启动。

syslog {

facility => …

host => …

port => …

severity => …

}

启动时有如下报错：

Couldn’t find any output plugin named ‘syslog’. Are you sure this is correct? Trying to load the syslog output plugin resulted in this error: no such file to load

 

安装后使用下列配置文件启动即可。

input{

syslog {

type => “rsyslog”

port => 514

}

}

filter{

}

output{

elasticsearch {

hosts => [“127.0.0.1:9200”]

flush_size => 1

index => “syslog-%{&