logstash 将Azure活动日志配置为Graylog / ELK

k4ymrczo  于 2023-06-04  发布在  Logstash
关注(0)|答案(1)|浏览(231)

我已将Azure活动日志导出到Blob存储。我使用Logstash 8.7.1版本沿着使用docker-compose的gelf输出,使用GelfUDP将这些日志发送到Graylog。对于Logstash的输入,使用Logstash的azure_blob_storage插件。
但是Logstash无法将这些日志发送到Graylog。

input {
     azure_blob_storage {
          connection_string => "DefaultEndpointsProtocol=https;AccountName=<BLOB_NAME>;AccountKey=<BLOB_ACCOUNT_KEY>;EndpointSuffix=core.usgovcloudapi.net"
         container => "insights-activity-logs"
         registry_create_policy => "start_over"
         codec => "json"
         addall => true
         path_filters => ['**/*.json']
         addfilename => true
         prefix => "resourceId=/"
         # Possible options: `do_not_break`, `with_head_tail`, `without_head_tail`
         interval => 5
     }
 }

filter {
    json {
        source => "message"
    }
    mutate {
        add_field => {"short_message" => ["This is short message"]}
        add_field => { "host" => "127.0.0.1" }
    }
    date {
        match => ["unixtimestamp", "UNIX"]
    }
}

output {
    gelf {
        host => "127.0.0.1"
        port => 12201
        protocol => "UDP"
        codec => "json"
    }
}

我还检查了stdout输出。它显示来自BLOB的所有消息。有什么问题吗?或者如何将Azure活动日志发送到Graylog?

yqlxgs2m

yqlxgs2m1#

通过配置Gelf TCP输出和Graylog Gelf TCP输入修复了此问题。
工作输出代码:

output {
    gelf {
        host => "127.0.0.1"
        port => 12201
        protocol => "TCP"
        codec => "json"
    }
}

相关问题