Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to use nxlog to forward vCenter messages to Logstash with the im_file input module and a pattern to specify the exact file(s) to watch. What would normally be simple is now needlessly complicated as vCenter's log rotation compresses the log and then increments the filename when the next log file is created. For example:

vpxd-1.log -> vpxd-1.log.gz -> vpxd-2.log

I want to forward messages from the vCenter vpxd.log log:

*vpxa(\.log|\.\d+(\.gz)?|-\d+\.log(\.gz)?)
share|improve this question
    
I decided to use Logstash instead of nxlog. –  HarryTruman Dec 24 '13 at 20:32

1 Answer 1

up vote 0 down vote accepted

Since vCenter logs are formatted differently from the ESXi logs, I decided to use Logstash instead of nxlog. I'll be setting up local filters in the forwarder to convert vCenter messages into a similar format as the ESXi messages.

See this guide for more info about running Logstash as a Windows service.


Service config:

C:
cd \logstash
set HOME=c:/logstash/sincedb
"C:\Program Files\Java\jdk1.7.0_45\bin\java.exe" -jar logstash-1.2.2.jar agent --config logstash.conf --log logstash.log

Logstash Config:

input {
  file {
    path => [ "C:/vmware_logs/vpxd-[0-5][0-9].log", "C:/vmware_logs/vpxd-alert-[0-5][0-9].log" ]
    type => "syslog"
    exclude => "*.gz"
  }
}

output {
  udp {
    host => "<address>"
    port => "514"
  }
  stdout {
    debug => true
  }
}
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.