Default logstash config

[4rce]

Good afternoon,

I apologize as I am not a professional and am still learning. I'll get straight to the point. I’m not entirely sure where to find the default configs for Logstash. For my task, I need to take logs that were sent to me in a .txt file and send them to Elasticsearch so that they can be properly parsed. I don't know how to directly pass the file since I don’t know what the default Logstash config looks like.

My mentor suggested using rsyslog. However, I wanted to try using the file module and pass the .txt file through a volume. I understand this is a workaround, but I am not familiar with Logstash parameters, so I hope you can forgive me.

I tried to write my own config. In the documentation, I found that you can create a custom config for sending data to other sources. To do this, you need to describe them in /opt/so/..../pipeline/config/custom/. Then, you should also add them as custom/myconfig.conf in defined_pipeline/manager and synchronize. But I can't figure out if it has been applied. I entered the so-logstash container and found a config at /usr/share/logstash/pipeline that doesn’t match what I wrote and tried to use.

Sorry, I’m just completely confused. I probably have a mess in my head.

[cm-ops]

Do you see the custom pipeline if you run sudo salt-call pillar.get logstash:defined_pipelines? If so, you can check the logstash pipeline stats for the pipeline you assigned it to, for example, manager. You would run sudo so-logstash-pipeline-stats manager in that case. In the output you should see your pipeline stats.

[4rce]

Good day, thank you for your response. The commands are working. I will look into this further. Could you let me know if I can send data to Logstash (and subsequently to Elasticsearch) in ways other than using the Elastic Agent? If so, which port should I use? Thank you in advance.

[4rce]

I would like to know how I can monitor incoming and outgoing data in Logstash, as well as the same for Elasticsearch. Thank you in advance.