It shouldn't matter whether NLS can talk to the internet or not as long as the install went okay. Can you telnet to any port mentioned above? For instance, 5544 or 2057.If this is on a private network without internet access, can it make any difference?
Code: Select all
telnet nls.ip.address 2057Code: Select all
service elasticsearch restart
service logstash restartCode: Select all
date
grep timezone /etc/php.iniCode: Select all
cd /usr/local/nagioslogserver/scripts
./change_timezone.sh -z America/ChicagoCode: Select all
date MMDDhhmmYYYYYou will need to setup the 'date' filter to parse your incoming logs. To do so, your input/filter chain might look something like this.The date filter is especially important for sorting events and for backfilling old data. If you don’t get the date correct in your event, then searching for them later will likely sort out of order.
In the absence of this filter, logstash will choose a timestamp based on the first time it sees the event (at input time), if the timestamp is not already set in the event. For example, with file input, the timestamp is set to the time of each read.
Code: Select all
syslog {
type => 'nagiosincominglogs'
port => 8999
}
if [type] == "nagiosincominglogs" {
date {
match => [ "logdate", "MMM dd YYY HH:mm:ss",
"MMM d YYY HH:mm:ss", "ISO8601" ]
}
}Code: Select all
if [program] == 'nagiosincominglogs' {
grok {
match => [ 'message', '%{LOGLEVEL:Loglevel} ?<mytimestamp>:\[%{YEAR:year}-%{MONTHNUM:month}-%{MONTHDAY:day} %{HOUR:hour}:%{MINUTE:minute}:%{SECOND:second}\]']
}
date {
match => [ "mytimestamp", "YYYY-MM-dd HH:mm:ss" ]
}
}
Code: Select all
INFO [2016-08-30 00:02:14,942][Some source info] - INFO - JMS Message sent, queue [queue:///somequeue?someclient=1], template [default], transaction id [11111111111], correlation id [222222222222222222222], body [333333333333333333 AAA BB 11011678571650511272016083012021400221000000000000IT^000176^N^^I^AAA^BB123^20160830^000214^AAA^BB123^20160830^163000^AAA^BB123^20160830^163000^^^^^AAA^AAA^AAA^AA^001^1234567890^P^WWW^WWW^777777777 ^^P^888888888^^^^SOMEDATA^SOMEMOREDATA^999999999^F^^^^^AA^QWERTY^**EOM**]
Code: Select all
if [type] == 'gsl_test' {
grok {
match => [ "message", "%{TIMESTAMP_ISO8601:logdate}" ]
}
date {
match => [ "logdate", "YYYY-MM-dd HH:mm:ss,SSS" ]
}
}