Elastic logstash

Middleware supports the ingestion of logs from Elastic Logstash.

Middleware currently supports ingesting logs from Logstash in the JSON format.

Filebeats agent is currently not supported.

Prerequisites#

Logstash agent should already be installed on your machine.

Logstash Configuration#

Open your Logstash pipeline configuration file (usually located in /etc/logstash/conf.d directory on Linux platform) and add the following filter and output configuration as described below:

json

filter {
    ruby {
        init => "
          require 'socket'
          @@hostname = Socket.gethostname
        "
        code => "event.set('host.id', @@hostname)
                 event.set('mw.account_key','<MW_API_KEY>')
                "
    }
}

output{
   http {
     Format => "json"
     Http_method => "post"
     headers => {
       "Content-Type" => "application/json"
     }

     Url => "https://<MW_UID>.middleware.io/logstash"
   }
}