syslog-ng添加用于弹性搜索的插件

Question

I have already installed syslog-ng. Now I want to write data directly to elastic search not using logstash.

There as an add-on in syslog-ng for elastic search but I couldn't figure out how to install it. Please let me know, if anybody has did this before or has any idea about it.

Thanks

Answer 1

There is a simple python based script which can be used using the program destination: https://github.com/balabit/syslog-ng-incubator/tree/master/scl/elasticsearch

If you don't mind using experimental software, there is a lot more high performance solution, compatible with Kibana, which needs the Java destination (available in syslog-ng incubator for 3.6 or 3.7 beta): https://github.com/juhaszviktor/ESDestination