Transportation of data from Filebeat over Logstash to InfluxDB

1

Hey gusy!

I’m trying to use beats and logstash for log transportation to influxdb. I got the logstash influxdb output plugin and set a config file as following:

input {
  beats {
    port => 5044
  }
}


filter {

  grok {
    match => { "message" => "%{IPORHOST:clientip} %{HTTPDUSER:ident} %{USER:auth} \[%{HTTPDATE:timestamp}\] \[%{NOTSPACE:referrer}\] \"(?:%{WORD:verb} %{NOTSPACE:request}(?: HTTP/%{NUMBER:httpversion})?|%    {DATA:rawrequest})\" %{NUMBER:response} (?:%{NUMBER:bytes}|-)"
    }
  }

}


output {
    influxdb {
    data_points => {}
    host => "influxdb.1m"
    }
    stdout {}
}

I don’t get any error messages in logs but Logstesh doesn’t create any db in influxdb and basically does nothing :smiley:

Can anyone help me here? Thanks for every response!!

Cheers! :v:

2

The default database is statistics. You may want to run logstash with --log.level DEBUG to get some visibility. My last suggestion is to set use_event_fields_for_data_points to true as leaving data_points empty may not get you what you want. See Influxdb output plugin | Logstash Reference [8.6] | Elastic

Which beat are you using?