<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<p>Greetings all:</p>
<p>I recently installed syslog-ng on my Debian 9 system. I have
tested syslog-ng with a file destination and everything seemed
fine. Now, I am attempting?? to set the destination to my local
Elasticsearch instance. However, I am receiving the following
error:</p>
<pre><i>Error parsing destination, destination plugin elasticsearch-http not found in /etc/syslog-ng/syslog-ng.conf at line 44, column 1:</i></pre>
<pre><i>elasticsearch-http(</i></pre>
<p><i>^^^^^^^^^^^^^^^^^^</i></p>
<p>My configuration, based on the documentation:</p>
<pre><i>elasticsearch-http(</i><i>
</i><i>?? index("syslog")</i><i>
</i><i>?? type("test")</i><i>
</i><i>?? url(<a class="moz-txt-link-rfc2396E" href="http:/localhost:9200/_bulk">"http:/localhost:9200/_bulk"</a>));</i><i>
</i><i>};</i>
</pre>
<p>Output of syslog-ng --version:</p>
<pre><i>syslog-ng 3.8.1</i><i>
</i><i>Installer-Version: 3.8.1</i><i>
</i><i>Revision: 3.8.1-10</i><i>
</i><i>Module-Directory: /usr/lib/syslog-ng/3.8</i><i>
</i><i>Module-Path: /usr/lib/syslog-ng/3.8</i><i>
</i><i>Available-Modules: disk-buffer,redis,date,afstomp,afprog,afsocket,pseudofile,confgen,csvparser,afsql,kvformat,geoip-plugin,afuser,afsmtp,system-source,mod-python,afamqp,riemann,linux-kmsg-format,dbparser,basicfuncs,syslogformat,graphite,afmongodb,json-plugin,cryptofuncs,affile,sdjournal,cef,add-contextual-data</i><i>
</i><i>Enable-Debug: off</i><i>
</i><i>Enable-GProf: off</i><i>
</i><i>Enable-Memtrace: off</i><i>
</i><i>Enable-IPv6: on</i><i>
</i><i>Enable-Spoof-Source: on</i><i>
</i><i>Enable-TCP-Wrapper: on</i><i>
</i><i>Enable-Linux-Caps: off</i></pre>
<div class="moz-signature">
<p>I saw no indication in the documentation that any special
modules/plugins needed to be loaded to use Elasticsearch as the
destination. Any pointers as to what the issue is would be
appreciated.??</p>
</div>
<div class="moz-signature">Thanks!<br>
</div>
<div class="moz-signature">-- <br>
</div>
<div class="moz-signature">
Kelly Marchewa<br>
<a class="moz-txt-link-abbreviated" href="mailto:kelly_marchewa@yahoo.com">kelly_marchewa@yahoo.com</a>
</div>
</body>
</html>