This topic describes how to configure Logtail in the Log Service console to collect data from Beats and Logstash.
Prerequisites
- Logtail is installed on the server that you use to collect data from Beats and Logstash.
For more information, see Install Logtail in Linux or Install Logtail in Windows.
Note Servers that run Linux support Logtail 0.16.9 or later. Servers that run Windows support Logtail 1.0.0.8 or later.
- Data is collected by using Logstash or Beats.
- For more information about how to collect data from Logstash, visit Logstash-Lumberjack-Output.
- For more information about how to collect data from Beats, visit Beats-Lumberjack-Output.
The procedure in this topic describes how to use Packetbeat to collect data transmitted on the local network, and use the Logtail Lumberjack plug-in to upload the data to Log Service. Data collected by using Packetbeat is sent to Logstash, as shown in the following sample script:
output.logstash: hosts: ["127.0.0.1:5044"]
Background information
Logstash and Beats (such as MetricBeat, PacketBeat, Winlogbeat, Auditbeat, Filebeat,
and Heartbeat) support the Lumberjack protocol. Therefore, Logtail can use the protocol
to upload data that is collected by Beats and Logstash to Log Service.
Note
- You can configure multiple Lumberjack plug-ins, but these plug-ins cannot listen on the same port.
- Lumberjack plug-ins support SSL. Data uploaded to Log Service from Logstash must be encrypted by using SSL.
Procedure
What to do next
After Logtail uploads data to Log Service, you can view the data in the Log Service console. The following content is the sample data uploaded to Log Service.
_@metadata_beat: packetbeat
_@metadata_type: doc
_@metadata_version: 6.2.4
_@timestamp: 2018-06-05T03:58:42.470Z
__source__: **. **. **.**
__tag__:__hostname__: *******
__topic__:
_beat_hostname: bdbe0b8d53a4
_beat_name: bdbe0b8d53a4
_beat_version: 6.2.4
_bytes_in: 56
_bytes_out: 56
_client_ip: 192.168.5.2
_icmp_request_code: 0
_icmp_request_message: EchoRequest(0)
_icmp_request_type: 8
_icmp_response_code: 0
_icmp_response_message: EchoReply(0)
_icmp_response_type: 0
_icmp_version: 4
_ip: 127.0.0.1
_path: 127.0.0.1
_responsetime: 0
_status: OK
_type: icmp