2

I would like my log data for servers such as Nginx to go directly to Logstash over a network. Logstash has TCP and UDP socket handlers built-in that would be perfect for receiving the data, but sending it is a problem. I know that there is the shipper and what not, but not having to manage logs on disk would be nice for projects where this log data isn't so critical (such as internal development servers).

Is there a crafty way I could create a socket, but one with a path on the file system for which Nginx would write to like it would any other log file? Assuming that's possible, how can I configure buffering and reconnection? I'd hate for the socket to die and the back pressure on logs start to tie up the server doing the logging.

2
  • You could also just let Nginx log to syslog, and then have syslog to forward all log events for a given facility (say, local5) to logstash. Syslog supports sending log events via UDP. You can also configure syslog not to log forwarded log events locally.
    – sbrattla
    Aug 16, 2015 at 7:12
  • Actually solution with syslog is much much better!
    – Navern
    Aug 16, 2015 at 11:23

2 Answers 2

2

I wouldn't recommend this as a long-term solution, but it could be good for debugging whether logstash or your shipper is working as expected.

On the logstash side:

input {
  tcp {
    port => 9000
  }
}

On your client's side:

cat logfile.log | nc logstash-server 9000
3

I haven't tried it, but a named pipe with netcat on the far end would probably do the trick. In case netcat dies you should run it under a process supervision framework (such as daemontools, runit, or systemd) so it respawns automatically.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .