Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
Logstash 1.4.1+ Collectd configuration
# This is the simplest definition, with the addition of a type
input {
udp {
port => 25826 # Must be specified. 25826 is the default for collectd
buffer_size => 1452 # Should be specified. 1452 is the default for recent versions of collectd
codec => collectd { } # This will invoke the default options for the codec
type => "collectd"
}
}
# This adds the definitions necessary to sign collectd messages with the credentials in collectd.auth
input {
udp {
port => 25826
buffer_size => 1452
codec => collectd {
authfile => "/usr/local/etc/collectd.auth"
security_level => "Sign"
}
type => "collectd"
}
}
# This adds the definitions necessary to encrypt collectd messages with the credentials in collectd.auth
input {
udp {
port => 25826
buffer_size => 1452
codec => collectd {
authfile => "/usr/local/etc/collectd.auth"
security_level => "Encrypt"
}
type => "collectd"
}
}
# This example shows how to modify worker and queue_size count
input {
udp {
port => 25826
buffer_size => 1452
workers => 3 # Default is 2
queue_size => 30000 # Default is 2000
codec => collectd { }
type => "collectd"
}
}
@deepybee

This comment has been minimized.

Copy link

deepybee commented Sep 24, 2014

Hi @untergeek, thanks for the excellent gists! 😄 👍

Can you clarify what benefit is gained by using the udp plugin with collectd codec over the collectd plugin? I am currently using the collectd plugin thus:

input {
  collectd {
  }
}

output {
  elasticsearch {
    protocol => "http"
    host => "my_es_cluster.foo"
  }
}

and every message gets tagged with _grokparsefailure, even though I am not using any filters at all on the collectd messages. Do you know if your method above would remedy this?

@danmilon

This comment has been minimized.

Copy link

danmilon commented Oct 1, 2014

@longshiptech It's about performance and a better design. See this blog post.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.
You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session.