VictoriaMetrics/deployment/docker/victorialogs/filebeat-syslog
Artem Navoiev e87c38c5d3 use latest image in example for VictoriaLogs and VictoriaMetrics to simplify the flow
Signed-off-by: Artem Navoiev <tenmozes@gmail.com>
2023-06-21 05:17:30 -07:00
..
docker-compose.yml use latest image in example for VictoriaLogs and VictoriaMetrics to simplify the flow 2023-06-21 05:17:30 -07:00
filebeat.yml remove docker from filebeat syslog 2023-06-21 03:59:31 -07:00
README.md examples add README 2023-06-21 03:59:31 -07:00

Docker compose Filebeat integration with VictoriaLogs for syslog

The folder contains the example of integration of filebeat with Victorialogs

To spin-up environment run the following command:

docker compose up -d 

To shut down the docker-compose environment run the following command:

docker compose down
docker compose rm -f

The docker compose file contains the following components:

  • filebeat - fileabeat is configured to accept syslog logs in rfc3164 format on 5140 port, you can find configuration in the filebeat.yml. It writes data in VictoriaLogs
  • VictoriaLogs - the log database, it accepts the data from filebeat by elastic protocol

the example of filebeat configuration(filebeat.yml)

filebeat.inputs:
  - type: syslog
    format: rfc3164
    protocol.tcp:
      host: "0.0.0.0:5140"

output.elasticsearch:
  hosts: [ "http://victorialogs:9428/insert/elasticsearch/" ]
  worker: 5
  bulk_max_size: 1000
  parameters:
    _msg_field: "message"
    _time_field: "@timestamp"
    _stream_fields: "host.name,process.program,process.pid,container.name"

Please, note that _stream_fields parameter must follow recommended best practices to achieve better performance.