Re: [rsyslog] Rsyslog queue in front of Logstash

On Sat, 2 Mar 2013, Ben Bradley wrote: At the moment my logs are just going over the network using tcp syslog (omfwd). Are there any other transport formats (JSON?) that are supported by Rsyslog that can be read by logstash? look at the lumberjack option in logstash, rsyslog supports JSON out

Re: [rsyslog] Rsyslog queue in front of Logstash

Hi Ben, 2013/3/2 Ben Bradley > On 01/03/13 14:51, Radu Gheorghe wrote: > >> Hello Ben, >> >> I'm not sure another rsyslog on the Logstash side will help if the >> bottleneck is on indexing to Elasticsearch. >> >> AFAIK logstash has an internal buffer of 20 or so entries, and when that's >> full

Re: [rsyslog] Rsyslog queue in front of Logstash

On 01/03/13 14:51, Radu Gheorghe wrote: Hello Ben, I'm not sure another rsyslog on the Logstash side will help if the bottleneck is on indexing to Elasticsearch. AFAIK logstash has an internal buffer of 20 or so entries, and when that's full (because the output is not fast enough) it blocks the

Re: [rsyslog] Logging local and on logserver

Hi Rainer, If I read it correctly, it looks like you simply do not transfer mail.* to the central server... I'll have a look at work on monday if I just forgot to copy it from my configuration or it's not in there. That would explain missing maillog Not sure based on the provided configu