tomasdanjonsson

version: '3.8'
services:
  # Elasticsearch service
  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch:8.7.1
    hostname: elasticsearch
    container_name: elasticsearchCS
    environment:
      - discovery.type=single-node # Run Elasticsearch as a single-node cluster
      - xpack.security.enabled=false # Disable X-Pack security features

tomasdanjonsson

filebeat.inputs:
  - type: log
    enabled: true
    paths:
      - /var/log/messages

output.logstash:
  hosts: ['logstash:5044']
  codec.json:
    pretty: true

tomasdanjonsson

input {
  beats {
    port => 5044
  }
}

output {
  http {
    url => "http://nifi:8081/contentListener"
    http_method => "post"

tomasdanjonsson

%{SYSLOGTIMESTAMP:timestamp} %{HOSTNAME:host} %{WORD:process}\[%{NUMBER:pid}\]: %{GREEDYDATA:message}

tomasdanjonsson

<%{POSINT:priority}>%{SPACE}%{SYSLOGTIMESTAMP:timestamp}%{SPACE}%{SYSLOGHOST:hostname}%{SPACE}%{DATA:application}\[%{POSINT:pid}\]:%{SPACE}%{GREEDYDATA:message}

tomasdanjonsson

version: '3.8'
services:
  # Elasticsearch service
  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch:8.7.1
    hostname: elasticsearch
    container_name: elasticsearchCS
    environment:
      - discovery.type=single-node # Run Elasticsearch as a single-node cluster
      - xpack.security.enabled=false # Disable X-Pack security features