Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Not all logs are being sent by syslog-loggly plugin #1

Open
reswob10 opened this issue Apr 17, 2019 · 0 comments
Open

Not all logs are being sent by syslog-loggly plugin #1

reswob10 opened this issue Apr 17, 2019 · 0 comments

Comments

@reswob10
Copy link

@reswob10 reswob10 commented Apr 17, 2019

Very simple config:

input {

    stdin {}

}

filter {

    csv {
            columns => ["user","ip","os"]
    }

}

output {

    stdout {codec => rubydebug}

    syslog {
            host => "1.1.12.5"
        port => "5514"
        protocol => "udp"
            codec => "json"

    }

}

used this as the input:

craig,,Win7

and entered it six times.

This showed up as the stdout:

craig,,Win7
{
"@Version" => "1",
"ip" => nil,
"host" => "0.0.0.0",
"@timestamp" => 2019-04-17T16:05:55.191Z, <----- received
"user" => "craig",
"message" => "craig,,Win7",
"os" => "Win7"
}
craig,,Win7
{
"@Version" => "1",
"ip" => nil,
"host" => "0.0.0.0",
"@timestamp" => 2019-04-17T16:06:05.361Z, <-----missing
"user" => "craig",
"message" => "craig,,Win7",
"os" => "Win7"
}
craig,,Win7
{
"@Version" => "1",
"ip" => nil,
"host" => "0.0.0.0",
"@timestamp" => 2019-04-17T16:06:13.033Z, <----- received
"user" => "craig",
"message" => "craig,,Win7",
"os" => "Win7"
}
craig,,Win7
{
"@Version" => "1",
"ip" => nil,
"host" => "0.0.0.0",
"@timestamp" => 2019-04-17T16:06:34.080Z, <----- missing
"user" => "craig",
"message" => "craig,,Win7",
"os" => "Win7"
}
craig,,Win7
{
"@Version" => "1",
"ip" => nil,
"host" => "0.0.0.0",
"@timestamp" => 2019-04-17T16:06:36.672Z, <------- received
"user" => "craig",
"message" => "craig,,Win7",
"os" => "Win7"
}
craig,,Win7
{
"@Version" => "1",
"ip" => nil,
"host" => "0.0.0.0",
"@timestamp" => 2019-04-17T16:07:07.161Z, <----- missing
"user" => "craig",
"message" => "craig,,Win7",
"os" => "Win7"
}

BUT, at the receiving end, I got this:

12:05:55.894818 IP 1.1.2.35.50017 > 1.1.12.5.5514: UDP, length 176
E.....@.>.eG
e.#
e...a....o.<13>Apr 17 16:05:55 0.0.0.0 LOGSTASH[-]: {"@Version":"1","ip":null,"host":"0.0.0.0","@timestamp":"2019-04-17T16:05:55.191Z","user":"craig","message":"craig,,Win7","os":"Win7"}
................
12:06:13.140318 IP 1.1.2.35.50017 > 1.1.12.5.5514: UDP, length 176
E.....@.>.eF
e.#
e...a....r.<13>Apr 17 16:06:13 0.0.0.0 LOGSTASH[-]: {"@Version":"1","ip":null,"host":"0.0.0.0","@timestamp":"2019-04-17T16:06:13.033Z","user":"craig","message":"craig,,Win7","os":"Win7"}
................
12:06:36.780246 IP 1.1.2.35.50017 > 1.1.12.5.5514: UDP, length 176
E.....@.>.eE
e.#
e...a....g.<13>Apr 17 16:06:36 0.0.0.0 LOGSTASH[-]: {"@Version":"1","ip":null,"host":"0.0.0.0","@timestamp":"2019-04-17T16:06:36.672Z","user":"craig","message":"craig,,Win7","os":"Win7"}
0 sourceTranslat

Shouldn't I have received 6 logs, not 3?

Note the @timestamps.

I'm on CentOS 6.10, version 7.0 of LS and version 0.1.0 of logstash-output-syslog-loggly

I am NOT sending this to loggly, just another syslog server. I was trying your plugin because I was having issues with the syslog plugin.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Linked pull requests

Successfully merging a pull request may close this issue.

None yet
1 participant
You can’t perform that action at this time.