logstash is http and on port 5044
what could be wrong. there is no error showing in apigee.
However if i try to write to logstash from outside apigee like a javascript code then it shows something in the logstash logs. though not accurate but still it generates some logs and also elastic search is creating index.
But only from apigee its not writing to logstash.
messagelogging policy
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<MessageLogging async="false" continueOnError="false" enabled="true" name="MessageLogging.Log">
<DisplayName>MessageLogging.Log</DisplayName>
<Syslog>
<Message>{msgLogs}</Message>
<Host>192.168.99.2</Host>
<Port>5044</Port>
<Protocol>TCP</Protocol>
<FormatMessage>true</FormatMessage>
<SSLInfo>
<Enabled>false</Enabled>
</SSLInfo>
</Syslog>
<logLevel>INFO</logLevel>
</MessageLogging>
logstash.conf
input {
tcp {
port => 5044
type => syslog
ssl_enable => false
}
}
filter {
mutate {
gsub => [
"message", "[\u0000]", ""
]
remove_field => ["timestamp", "host", "facility_label", "severity_label", "severity", "facility", "priority"]
}
grok {
match => {"message" => "<%{NUMBER:priority_index}>%{DATESTAMP_OTHER:apigeeTimestamp}%{LOGLEVEL}: %{GREEDYDATA:apigeeMessage}"}
remove_field => ["message"]
}
json {
source => "apigeeMessage"
target => "message"
remove_field => ["apigeeMessage"]
}
}
output {
#added below line to see how the message is outputed/parsed with logstash filer, you can remove below line (only stdout { codec => rubydebug }), if necessary.
stdout { codec => rubydebug }
elasticsearch {
hosts => ["http://192.168.99.2:9200"]
index => "apigee-%{+YYYY.MM.dd}"
ssl => false
}
}
Incidentally from telnet its working fine.
But i think somehow apigee is not able to connect to ip http://192.168.99.2:5044/. This ip is on my local docker. However this ip accessible thru internet but somehow not thru apigee. What could be the issue.
LinkedIn
Twitter
