Skip to content

nnachefski/logstash-input-journald

 
 

Repository files navigation

logstash-input-journald

POC systemd journal Logstash input

Example config

input {
     journald {
       lowercase => true
       seekto => "head"
       thisboot => true
       type => "systemd"
       tags => [ "coreos" ]
     }
}

output {
  stdout {codec => rubydebug}
}

Install with

git clone https://github.com/stuart-warren/logstash-input-journald.git
cd logstash-input-journald
gem build logstash-input-journald.gemspec
sudo /path/to/logstash/bin/plugin install /path/to/git/logstash-input-journald/logstash-input-journald-0.0.1.gem

Sincedb

This plugin creates a sincedb in your home, called .sincedb_journal. It automatically stores the cursor to the journal there, so when you restart logstash, only new messages are read. When executing the plugin the second time (which means the sincedb exists), seekto, and thisboot are ignored. If you don't want the sincedb, configure it's path to /dev/null. Tips

Ensure the user you are running logstash as has read access to the journal files /var/log/journal/*/*

Issues

Killing the logstash process takes a long time...

About

Logstash input plugin for journald

Resources

License

Stars

Watchers

Forks

Packages

No packages published

Languages

  • Ruby 100.0%