ELK-syslog-format-conf

input {

syslog {

type => "system-syslog"

host => "10.12.133.43"

port => "514"

}

}

filter {

}

output {

stdout {

codec => "rubydebug"

}

}

配置rsyslog

vim /etc/rsyslog.conf

*.* @@10.12.133.43:514