cybersamx/logstash_forwarder_on_ubuntu.md

## logstash_forwarder_on_ubuntu.md

      
    Raw
  

              logstash_forwarder_on_ubuntu.md
            
          
    Installation

Add an apt repository and install the logstash-forwarder package.
$ sudo sh -c 'echo "deb http://packages.elasticsearch.org/logstashforwarder/debian stable main" > /etc/apt/sources.list.d/logstash.list'
$ wget -O - http://packages.elasticsearch.org/GPG-KEY-elasticsearch | sudo apt-key add -
$ sudo apt-get update
$ sudo apt-get install logstash-forwarder

Startup Script

Set up a startup script for logstash forwarder.
$ cd /etc/init.d/
$ sudo wget https://raw.github.com/elasticsearch/logstash-forwarder/master/logstash-forwarder.init -O logstash-forwarder
$ sudo chmod +x logstash-forwarder
$ sudo update-rc.d logstash-forwarder defaults

Configure

Tell logstash forwarder what logs to capture and where to send those logs.
$ sudo mkdir -p /etc/pki/tls/certs
$ sudo vi /etc/pki/tls/certs/logstash-forwarder.crt  # Download this cert from the logstash server
$ sudo vi /etc/logstash-forwarder

The content of /etc/logstash-forwarder should look like this:
{
  "files" : [
    {
      "fields" : {
        "type" : "syslog"
      },
      "paths" : [
        "/var/log/syslog",
        "/var/log/auth.log",
        "<path to other log files you wish to capture>"
      ]
    }
  ],
  "network" : {
    "servers" : [
      "<logstash server hostname>:5000"
    ],
    "ssl ca" : "/etc/pki/tls/certs/logstash-forwarder.crt",
    "timeout" : 15
  }
}