Ingesting logs from Elastic Logstash

Middleware supports the ingestion of logs from Elastic Logstash.

Middleware currently supports ingesting logs from Logstash in the JSON format.

Filebeats agent is currently not supported.

Prerequisites

Logstash agent should already be installed on your machine.

Logstash Configuration

Open your Logstash pipeline configuration file (usually located in /etc/logstash/conf.d directory on Linux platform) and add the following filter and output configuration as described below:

filter {
    ruby {
        init => "
          require 'socket'
          @@hostname = Socket.gethostname
        "
        code => "event.set('host.id', @@hostname)
                 event.set('mw.account_key','<MW_API_KEY>')
                "
    }

Once this configuration is added, restart the Logstash. You should now see logs in the logs section of your Middleware account.