Skip to content

Instantly share code, notes, and snippets.

@untergeek
Created May 7, 2014 15:48
Show Gist options
  • Star 19 You must be signed in to star a gist
  • Fork 7 You must be signed in to fork a gist
  • Save untergeek/ab85cb86a9bf39f1fc6d to your computer and use it in GitHub Desktop.
Save untergeek/ab85cb86a9bf39f1fc6d to your computer and use it in GitHub Desktop.
Logstash 1.4.1+ Collectd configuration
# This is the simplest definition, with the addition of a type
input {
udp {
port => 25826 # Must be specified. 25826 is the default for collectd
buffer_size => 1452 # Should be specified. 1452 is the default for recent versions of collectd
codec => collectd { } # This will invoke the default options for the codec
type => "collectd"
}
}
# This adds the definitions necessary to sign collectd messages with the credentials in collectd.auth
input {
udp {
port => 25826
buffer_size => 1452
codec => collectd {
authfile => "/usr/local/etc/collectd.auth"
security_level => "Sign"
}
type => "collectd"
}
}
# This adds the definitions necessary to encrypt collectd messages with the credentials in collectd.auth
input {
udp {
port => 25826
buffer_size => 1452
codec => collectd {
authfile => "/usr/local/etc/collectd.auth"
security_level => "Encrypt"
}
type => "collectd"
}
}
# This example shows how to modify worker and queue_size count
input {
udp {
port => 25826
buffer_size => 1452
workers => 3 # Default is 2
queue_size => 30000 # Default is 2000
codec => collectd { }
type => "collectd"
}
}
@deepybee
Copy link

Hi @untergeek, thanks for the excellent gists! 😄 👍

Can you clarify what benefit is gained by using the udp plugin with collectd codec over the collectd plugin? I am currently using the collectd plugin thus:

input {
  collectd {
  }
}

output {
  elasticsearch {
    protocol => "http"
    host => "my_es_cluster.foo"
  }
}

and every message gets tagged with _grokparsefailure, even though I am not using any filters at all on the collectd messages. Do you know if your method above would remedy this?

@danmilon
Copy link

danmilon commented Oct 1, 2014

@longshiptech It's about performance and a better design. See this blog post.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment