Présentation

Utilisez la source Logstash d’Observability Pipelines pour recevoir des journaux de votre agent Logstash.

Vous pouvez également utiliser la source Logstash pour envoyer des journaux à Observability Pipelines en utilisant Filebeat.

Prérequis

To use Observability Pipelines’ Logstash source, you need the following information available:

• Logstash address, such as 0.0.0.0:8088. The Observability Pipelines Worker listens on this bind address to receive logs from your applications. Later on, you configure your applications to send logs to this address.
• The appropriate TLS certificates and the password you used to create your private key, if your forwarders are globally configured to enable SSL.

Configuration

Configurez cette source lorsque vous configurez un pipeline. Vous pouvez configurer un pipeline dans l’interface utilisateur, en utilisant l’API ou avec Terraform. Les instructions de cette section concernent la configuration de la source dans l’UI.

Après avoir sélectionné la source Logstash dans l’interface utilisateur du pipeline, saisissez l’identifiant de votre adresse Logstash. Si vous le laissez vide, le default est utilisé.

Paramètres TLS optionnels

Toggle the switch to Enable TLS.

• If you are using Secrets Management, enter the identifier for the key pass. See Secret defaults for the default used if the field is left blank.
• Enter the following certificate and key files:
  • Server Certificate Path: The path to the certificate file that has been signed by your Certificate Authority (CA) root file in DER, PEM, or CRT (X.509).
  • (Optional) CA Certificate Path: The path to the certificate file that is your Certificate Authority (CA) root file in DER, PEM, or CRT (X.509).
  • (Optional) Private Key Path: The path to the .key private key file that belongs to your Server Certificate Path in DER, PEM, or CRT (PKCS #8) format.
  • Notes:
    • The configuration data directory /var/lib/observability-pipelines-worker/config/ is automatically appended to the file paths. See Advanced Worker Configurations for more information.
    • The file must be readable by the observability-pipelines-worker group and user.

• (Optional) Toggle Verify certificate to require connecting clients to present a valid client certificate. This enforces mutual TLS (mTLS), where the Worker verifies the identity of each connecting client.

Valeurs par défaut des secrets

These are the defaults used for secret identifiers and environment variables.

Envoyez des journaux à l’Observability Pipelines Worker via Logstash

To configure Logstash to send logs to the Observability Pipelines Worker, use the following output configuration:

output {
  http {
    url => "http://127.0.0.1:9997"
    http_method => "post"
    format => "json"
  }
}

Note: Logstash requires SSL to be configured.