一、定义客户端rsyslog配置文件
# vi/etc/rsyslog.conf
*.* @@192.168.1.75:514 #将所有syslog日志发送至 192.168.1.75 的514端口
# :wq
# systemctl restart rsyslog
二、192.168.1.75的logstash配置
input {
syslog {
type => "system-syslog"
host => "192.168.1.75"
port => "514"
}
}
output {
if [type] == "system-syslog" {
elasticsearch {
hosts =>["192.168.1.75:9200"]
index =>"syslog-%{+YYYY.MM.dd}"
}
}
}