Skip to content

ingestor_syslog job from logsearch/206.0.0

Github source: 1fe0fb4a or master branch

Properties

archiver

enabled

Additional queue for archive (Redis only)

Default
false

logstash

heap_size

sets jvm heap sized

log_level

The default logging level (e.g. WARN, DEBUG, INFO)

Default
info

metadata_level

Whether to include additional metadata throughout the event lifecycle. NONE = disabled, DEBUG = fully enabled

Default
NONE

plugins

Array of hashes describing logstash plugins to install

Default
[]
Example
- name: logstash-output-cloudwatchlogs
  version: 2.0.0

logstash_ingestor

debug

Debug level logging

Default
false

filters

Filters to execute on the ingestors

Default
""

outputs

A list of output plugins, with a hash of options for each of them. Please refer to example below.

Default
  - options: {}
    plugin: redis
Example
outputs:
- options:
    exchange_type: direct
    host: 192.168.1.1
    password: c1oudbunny
    user: logsearch
  plugin: rabbitmq

relp

port

Port to listen for RELP messages

Default
2514

syslog

port

Port to listen for syslog messages

Default
5514

syslog_tls

port

Port to listen for syslog-TLS messages (omit to disable)

skip_ssl_validation

Verify the identity of the other end of the SSL connection against the CA.

Default
false
ssl_cert

Syslog-TLS SSL certificate (file contents, not a path) - required if logstash_ingestor.syslog_tls.port set

ssl_key

Syslog-TLS SSL key (file contents, not a path) - required if logstash_ingestor.syslog_tls.port set

redis

congestion_interval

How often to check for queue length. Default is one second. Zero means to check on every message

congestion_threshold

Max number of messages to allow in the queue. Will stop (and drop) ingesting new messages when this is reached

host

Redis host of queue

key

Name of queue to pull messages from

Default
logstash

port

Redis port of queue

Default
6379

Templates

Templates are rendered and placed onto corresponding instances during the deployment process. This job's templates will be placed into /var/vcap/jobs/ingestor_syslog/ directory (learn more).

  • bin/ingestor_syslog_ctl (from bin/ingestor_syslog_ctl)
  • bin/monit_debugger (from bin/monit_debugger)
  • config/log4j2.properties (from config/log4j2.properties.erb)
  • config/logstash.conf (from config/logstash.conf.erb)
  • config/syslog_tls.crt (from config/syslog_tls.crt.erb)
  • config/syslog_tls.key (from config/syslog_tls.key.erb)
  • data/properties.sh (from data/properties.sh.erb)
  • helpers/ctl_setup.sh (from helpers/ctl_setup.sh)
  • helpers/ctl_utils.sh (from helpers/ctl_utils.sh)

Packages

Packages are compiled and placed onto corresponding instances during the deployment process. Packages will be placed into /var/vcap/packages/ directory.