I'm still not getting it. My standard syslog data works fine is there something behind the scenes ?
My Syslog ES target wis working but getting nothing in the beats target no errors either.
destination d_es {
elasticsearch2(
disk-buffer(
reliable(no) # If set to no, the normal disk-buffer will be used. This provides a faster, option
dir("/opt/syslog-ng/buffer")
disk-buf-size(10485760)
mem-buf-length(100000) # number of messages stored in overflow queue
)
client-mode("http")
index("syslog-ng_${YEAR}.${MONTH}.${DAY}")
type("syslog") # Description: The type of the index. For example, type("test")
template("$(format-json --scope rfc3164 --scope nv-pairs --exclude R_DATE --key ISODATE)\n")
concurrent-requests("5") # Number of concurrrent batches
flush_limit("5000") # The number of messages in a single batch
skip-cluster-health-check("yes")
cluster("hal")
client_lib_dir("/usr/share/elasticsearch/lib")
);
};
destination d_es_beats {
elasticsearch2(
disk-buffer(
reliable(no) # If set to no, the normal disk-buffer will be used. This provides a faster, option
dir("/opt/syslog-ng/buffer/beats")
disk-buf-size(10485760)
mem-buf-length(100000) # number of messages stored in overflow queue
) # END DiskBuffer
client-mode("http")
index("winlogbeat-${YEAR}.${MONTH}.${DAY}")
type("winlogbeat") # Description: The type of the index. For example, type("test")
#template("$(format-json --scope rfc3164 --scope nv-pairs --exclude R_DATE --key ISODATE)\n")
#template("$(format-json -s all-nv-pairs -p @timestamp=$ISODATE -p @message=$MESSAGE)")
template("$(format-json -s all-nv-pairs -p @timestamp=$ISODATE -p @message=$MESSAGE)")
#template("${MESSAGE}")
concurrent-requests("5") # Number of concurrrent batches
flush_limit("5000") # The number of messages in a single batch
skip-cluster-health-check("yes")
cluster("hal")
client_lib_dir("/usr/share/elasticsearch/lib")
);
};