Hi Jochen,
I set up a filebeat forwarder on the Graylog server just to test localhost
forwarding with the following configurations but even though Graylogs
inputs page shows an active connection no data is being ingested:
- bind_address:
0.0.0.0
- override_source:
admin
- port:
5044
- recv_buffer_size:
1048576
- tcp_keepalive:
false
- tls_cert_file:
*<empty>*
- tls_client_auth:
disabled
- tls_client_auth_cert_file:
*<empty>*
- tls_enable:
false
- tls_key_file:
*<empty>*
- tls_key_password:
********
Filebeat (/etc/filebeat/filebeat.yml):
filebeat:
prospectors:
-
paths:
- /var/log/auth.log
- /var/log/syslog
input_type: log
document_type: syslog
registry_file: /var/lib/filebeat/registry
output:
logstash:
hosts: ["127.0.0.1:5044"]
bulk_max_size: 1024
logging:
files:
rotateeverybytes: 10485760 # = 10MB
I took out the TLS configuration just to rule that out as a problem and the
filebeat.yml is pretty basic.
--
You received this message because you are subscribed to the Google Groups
"Graylog Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/graylog2/84fb33a7-0fd8-491d-9a83-208a4c321350%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
