Nagios Support Forum

Please verify that your permissions are correct: Can you post your inputs that you defined globally? I would like to take a look at them.

[root@localhost conf.d]# more 000_inputs.conf
#
# Logstash Configuration File
# Dynamically created by Nagios Log Server
#
# DO NOT EDIT THIS FILE. IT WILL BE OVERWRITTEN.
#
# Created Tue, 31 Mar 2015 17:12:55 -0400
#

#
# Global inputs
#



#
# Local inputs
#

input {
syslog {
type => 'syslog'
port => 514
}
}
[root@localhost conf.d]# more 500_filters.conf
#
# Logstash Configuration File
# Dynamically created by Nagios Log Server
#
# DO NOT EDIT THIS FILE. IT WILL BE OVERWRITTEN.
#
# Created Tue, 31 Mar 2015 17:12:55 -0400
#

#
# Global filters
#

filter {
if [program] == 'apache_access' {
grok {
match => [ 'message', '%{COMBINEDAPACHELOG}']
}
date {
match => [ 'timestamp', 'dd/MMM/yyyy:HH:mm:ss Z' ]
}
mutate {
replace => [ 'type', 'apache_access' ]
convert => [ 'bytes', 'integer' ]
convert => [ 'response', 'integer' ]
}
}

if [program] == 'apache_error' {
grok {
match => [ 'message', '\[(?<timestamp>%{DAY:day} %{MONTH:month} %{MONTHDAY} %{TIME} %{YEAR})\] \[%{WORD:clas
s}\] \[%{WORD:originator} %{IP:clientip}\] %{GREEDYDATA:errmsg}']
}
mutate {
replace => [ 'type', 'apache_error' ]
}
}
}

#
# Local filters
#


[root@localhost conf.d]# more 999_outputs.conf
#
# Logstash Configuration File
# Dynamically created by Nagios Log Server
#
# DO NOT EDIT THIS FILE. IT WILL BE OVERWRITTEN.
#
# Created Tue, 31 Mar 2015 17:12:55 -0400
#

#
# Required output for Nagios Log Server
#

output {
elasticsearch {
cluster => '81d8dd31-4078-4c51-a8d3-9d102bb9cd6c'
host => 'localhost'
index_type => '%{type}'
node_name => '474fc199-f9b8-4f20-ad18-e65d39bb7345'
protocol => 'transport'
workers => 4
}
}

#
# Global outputs
#



#
# Local outputs
#


[root@localhost conf.d]#

This is from the web interface.

tcp {
type => 'import_json'
tags => 'import_json'
port => 2057
codec => json
}

tcp {
type => 'import_raw'
tags => 'import_raw'
port => 2056
}

tcp {
type => 'eventlog'
port => 3515
codec => json {
charset => 'CP1252'
}
}

syslog {
type => 'syslog'
port => 514
}

syslog {
type => 'syslog'
port => 514
}

Please remove one of your syslog entries - you cannot have multiple inputs on the same port (unless they are using different protocols). After that, Apply Configuration and let us know if that works. Thanks!

I deleted the last entry and every time I do that it returns.

Did you define any local inputs or filters as shown in my screenshot? If so, I recommend deleting them and using Global Configuration exclusively.

I did and that is when everything started working.

The red circle keeps coming back no mater how many times I delete it.

Great - so is everything working well? Do you have any questions?

What I mean is when I defined the local port to the local instance that is when everything started working.

Can you please show me your logstash configuration file? Also, from the Web GUI please remove the local input. We will stick with a Global input for now.

I would also like you to verify permissions: Best,

Jesse