I don't understand how logstash-forwarder sent log to the elk server

Question

I have installed Logstash-Forwarder on Client Server and when I'm checking my Kibana I haven't seen any log stored. What I wanted to ask is how do you direct the log from client with logstash-forwarder to elk server?

Answer 1

Logstash forwarder uses lumberjack for log transport. The lumberjack protocol exists to provide a network protocol for transmission that is secure, low latency, low resource usage, and reliable. Therefore it uses TCP and SSL/TLS certificates.

I would recommend you this page to understand logstash forwarder. To put it in a nutshell, you need to build a correct SSL/TLS certificate infrastructure and specify a lumberjack input on your logstash server:

Config example:

input {
  lumberjack {
    # The port to listen on
    port => 12345

    # The paths to your ssl cert and key
    ssl_certificate => "path/to/ssl.crt"
    ssl_key => "path/to/ssl.key"

    # Set this to whatever you want.
    type => "somelogs"
  }
}

However, I would recommend you to try a few simpler inputs at first. Start with stdin{} and perhaps try syslog{} to understand the procedure and see results in kibana.