Thanks Jochen. I have configured beats plugin and then created new beats input from Graylog UI. Do we need to install logstash or elasticsearch separately for output? I started filebeat by running below command, getting connection error if i look into stdout file (gave external ip of graylog server and default port 5044 in logstash output section, and we have opened the port 5044 also). Am i missing anything here?
./filebeat -e -c filebeat.yml -d publish >& stdout Error - "count": 1, "fields": null, "input_type": "log", "message": "[2016-02-06T08:35:33.551+00:00] [dev1wlc__server_1] [NOTIFICATION] [] [oracle.wsm.policy.model.impl.PolicySet] [tid: [STANDBY].ExecuteThread: '1' for queue: 'weblogic.kernel.Default (self-tuning)'] [userId: \u003canonymous\u003e] [ecid: b49c11d0-5d9a-432c-a956-608ba4be3d03-00000005,0] [APP: wsm-pm] [[", "offset": 190854, "source": "/u01/data/domains/dev1wlc_domain/servers/dev1wlc__server_1/logs/dev1wlc__server_1-diagnostic.log", "type": "log" } 2016/03/09 23:42:11.894846 output.go:87: DBG output worker: publish 50 events 2016/03/09 23:42:13.391503 single.go:126: INFO Connecting error publishing events (retrying): Head http://54.181.142.178:5044: EOF 2016/03/09 23:42:13.391587 single.go:152: INFO send fail 2016/03/09 23:42:13.391606 single.go:159: INFO backoff retry: 1s 2016/03/09 23:42:15.834765 single.go:126: INFO Connecting error publishing events (retrying): Head http://54.181.142.178:5044: EOF 2016/03/09 23:42:15.834798 single.go:152: INFO send fail 2016/03/09 23:42:15.834810 single.go:159: INFO backoff retry: 2s 2016/03/09 23:42:19.292124 single.go:126: INFO Connecting error publishing events (retrying): Head http://54.181.142.178:5044: EOF 2016/03/09 23:42:19.292156 single.go:152: INFO send fail 2016/03/09 23:42:19.292168 single.go:159: INFO backoff retry: 4s 2016/03/09 23:42:24.753438 single.go:126: INFO Connecting error publishing events (retrying): Head http://54.181.142.178:5044: EOF 2016/03/09 23:42:24.753492 single.go:152: INFO send fail On Wednesday, March 9, 2016 at 2:00:36 AM UTC-8, Jochen Schalanda wrote: > > Hi, > > there's a third-party plugin for support the Beats protocol in Graylog: > https://marketplace.graylog.org/addons?tag=filebeat > > Cheers, > Jochen > > On Tuesday, 8 March 2016 19:02:09 UTC+1, Warriors wrote: >> >> Thanks Jochen, I have installed filebeat on my linux server from where i >> want to read log files. How do i send logs to graylog which is hosted on >> AWS. My AWS Graylog URL is - >> http://ec2-54-153-172-32.us-west-1.compute.amazonaws.com/ >> >> On Wednesday, March 2, 2016 at 3:34:56 AM UTC-8, Jochen Schalanda wrote: >>> >>> Hi, >>> >>> there are several other log shippers, like nxlog >>> <https://nxlog.co/docs/nxlog-ce/nxlog-reference-manual.html>, logstash >>> <https://www.elastic.co/products/logstash>, or filebeat >>> <https://www.elastic.co/products/beats/filebeat>, which can be used to >>> read files on a system and send them to Graylog. >>> >>> Additionally, you might be able to tweak the internal logging framework >>> of WebLogic to send the messages directly to Graylog using one of the >>> existing Log4j GELF appenders: >>> https://docs.oracle.com/cd/E28280_01/web.1111/e13739/config_logs.htm#WLLOG138 >>> , https://marketplace.graylog.org/addons?tag=log4j >>> >>> >>> Cheers, >>> Jochen >>> >>> On Wednesday, 2 March 2016 00:51:24 UTC+1, Warriors wrote: >>>> >>>> Can we collect the weblogic logs and fwd to graylog server with pout >>>> installing Graylog collector on the client machine? >>>> >>> -- DISCLAIMER: This message, including any attachments, contains confidential information intended for a specific individual and purpose, and is protected by law. If you are not the intended recipient, please contact the sender immediately by reply e-mail and destroy all copies. You are hereby notified that any disclosure, copying, or distribution of this message, or the taking of any action based on it, is strictly prohibited. -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/c4a0ce42-cc62-4fce-b07f-224aeb02a385%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
