initial commit

files/logstash/logstash-init

@@ -0,0 +1,25 @@
+# logstash-indexer.conf# logstash - indexer instance
+#
+
+description     "logstash indexer instance"
+
+start on virtual-filesystems
+stop on runlevel [06]
+
+respawn
+respawn limit 5 30
+limit nofile 65550 65550
+
+env HOME=/opt/logstash
+env JAVA_OPTS='-Xms512m -Xmx512m'
+
+chdir /opt/logstash
+setuid root
+console log
+
+# for versions 1.1.1 - 1.1.4 the internal web service crashes when touched
+# and the current workaround is to just not run it and run Kibana instead
+
+script
+        exec java -jar /opt/logstash/share/logstash.jar agent -f /opt/logstash/etc/logstash.conf --log /var/log/logstash/logstash-indexer.out
+end script

files/logstash/logstash.conf

@@ -0,0 +1,26 @@
+# logstash configuration
+
+# Define inputs
+input {
+    syslog {
+        debug => false
+        host => "0.0.0.0"
+        port => 5514
+        type => "linux-syslog"
+    }
+}
+filter {
+    grok {
+        type => "linux-syslog"
+        pattern => "%{SYSLOGLINE}"
+    }
+}
+# Define outputs
+output {
+    # send events to stdout for easy debugging
+    # stdout { debug => true debug_format => "json" }
+
+    elasticsearch {
+        host => "127.0.0.1"
+    }
+}