Join GitHub today
GitHub is home to over 50 million developers working together to host and review code, manage projects, and build software together.
Sign upGitHub is where the world builds software
Millions of developers and companies build, ship, and maintain their software on GitHub — the largest and most advanced development platform in the world.
Very simple config:
input {
}
filter {
}
output {
}
used this as the input:
craig,,Win7
and entered it six times.
This showed up as the stdout:
craig,,Win7
{
"@Version" => "1",
"ip" => nil,
"host" => "0.0.0.0",
"@timestamp" => 2019-04-17T16:05:55.191Z, <----- received
"user" => "craig",
"message" => "craig,,Win7",
"os" => "Win7"
}
craig,,Win7
{
"@Version" => "1",
"ip" => nil,
"host" => "0.0.0.0",
"@timestamp" => 2019-04-17T16:06:05.361Z, <-----missing
"user" => "craig",
"message" => "craig,,Win7",
"os" => "Win7"
}
craig,,Win7
{
"@Version" => "1",
"ip" => nil,
"host" => "0.0.0.0",
"@timestamp" => 2019-04-17T16:06:13.033Z, <----- received
"user" => "craig",
"message" => "craig,,Win7",
"os" => "Win7"
}
craig,,Win7
{
"@Version" => "1",
"ip" => nil,
"host" => "0.0.0.0",
"@timestamp" => 2019-04-17T16:06:34.080Z, <----- missing
"user" => "craig",
"message" => "craig,,Win7",
"os" => "Win7"
}
craig,,Win7
{
"@Version" => "1",
"ip" => nil,
"host" => "0.0.0.0",
"@timestamp" => 2019-04-17T16:06:36.672Z, <------- received
"user" => "craig",
"message" => "craig,,Win7",
"os" => "Win7"
}
craig,,Win7
{
"@Version" => "1",
"ip" => nil,
"host" => "0.0.0.0",
"@timestamp" => 2019-04-17T16:07:07.161Z, <----- missing
"user" => "craig",
"message" => "craig,,Win7",
"os" => "Win7"
}
BUT, at the receiving end, I got this:
12:05:55.894818 IP 1.1.2.35.50017 > 1.1.12.5.5514: UDP, length 176
E.....@.>.eG
e.#
e...a....o.<13>Apr 17 16:05:55 0.0.0.0 LOGSTASH[-]: {"@Version":"1","ip":null,"host":"0.0.0.0","@timestamp":"2019-04-17T16:05:55.191Z","user":"craig","message":"craig,,Win7","os":"Win7"}
................
12:06:13.140318 IP 1.1.2.35.50017 > 1.1.12.5.5514: UDP, length 176
E.....@.>.eF
e.#
e...a....r.<13>Apr 17 16:06:13 0.0.0.0 LOGSTASH[-]: {"@Version":"1","ip":null,"host":"0.0.0.0","@timestamp":"2019-04-17T16:06:13.033Z","user":"craig","message":"craig,,Win7","os":"Win7"}
................
12:06:36.780246 IP 1.1.2.35.50017 > 1.1.12.5.5514: UDP, length 176
E.....@.>.eE
e.#
e...a....g.<13>Apr 17 16:06:36 0.0.0.0 LOGSTASH[-]: {"@Version":"1","ip":null,"host":"0.0.0.0","@timestamp":"2019-04-17T16:06:36.672Z","user":"craig","message":"craig,,Win7","os":"Win7"}
0 sourceTranslat
Shouldn't I have received 6 logs, not 3?
Note the @timestamps.
I'm on CentOS 6.10, version 7.0 of LS and version 0.1.0 of logstash-output-syslog-loggly
I am NOT sending this to loggly, just another syslog server. I was trying your plugin because I was having issues with the syslog plugin.