[syslog-ng] Elasticsearch destination

Russell Fulton r.fulton at auckland.ac.nz
Thu Oct 23 01:17:39 CEST 2014


We are already using the open source version of syslog-ng and I am about to set up some elastic search instances and would much prefer to feed data direct from syslog-ng rather than go through logstash (I already have a heap of patterndb parsers and performance should be way better!)

I have spent an hour or so with Google and have found various references to elastic search destination being available but I can find no mention of it in the release notes for 3.6.1.  I have also downloaded the the tarball and unpacked it but could not find any evidence of the module , nore is there any mention of it in the manual.

As of now what is the recommended way of getting parsed data from OS syslog-ng into ES?

Thanks, Russell

More information about the syslog-ng mailing list