Hi Chris, On Saturday, 24 September 2016 21:11:22 UTC+2, Chris wrote: > > I am curious as to what the beats forwarders configuration should be. I am > used to using Logstash to parse logs before sending to Elasticsearch so I > am wondering how the Graylog Beats input works? Is the data sent directly > to Elasticsearch so the forwarder output should be Elasticsearch. I ask > this as I noticed a comment on the plugin from Joschi saying that Logstash > is the correct output. >
Through an unfortunate series of events, the output for the Beats protocol (ex-Lumberjack protocol) is called "logstash" in *beats. So if you want to use Graylog to ingest these messages, you have to use a "logstash" output in your beats configuration. Cheers, Jochen -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/5aaadfd9-2523-480d-8400-a0236a696771%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
