Logstash Forwarder Upstart

certificate

mkdir /etc/logstash/private
mkdir /etc/logstash/certs
openssl req -x509 -batch -nodes -newkey rsa:2048 -keyout /etc/logstash/private/server.key -out /etc/logstash/certs/server.crt

logstash-forwarder.conf

description "logstash forwarder"

start on runlevel [2345]
stop on runlevel [06]

expect fork

script
  test -d /opt/logstash-forwarder
  cd /opt/logstash-forwarder/bin
  exec logstash-forwarder -config /etc/logstash-forwarder.json -spool-size 100 -log-to-syslog
end script

logstash-forwarder.json

{
  "network": {
    "servers": [ "localhost:5043" ],
    "ssl certificate": "/etc/logstash/certs/server.crt",
    "ssl key": "/etc/logstash/private/server.key",
    "ssl ca": "/etc/logstash/certs/server.crt",
    "timeout": 15
  },

  "files": [
    {
      "paths": [
        "/var/log/messages",
        "/var/log/*.log"
      ],
      "fields": { "type": "syslog" }
    }, {
      "paths": [ "-" ],
      "fields": { "type": "stdin" }
    }, {
      "paths": [
        "/var/log/apache/httpd-*.log"
      ],
      "fields": { "type": "apache" }
    }
  ]
}

logstash.sh

#!/bin/sh
#
# Logstash Forwarder Installer Script
#
export LOGSTASH_SERVER="10.254.254.3"

if [ -d /opt/logstash-forwarder/bin ];
then
  echo "Logstash Forwarder already installed"
  exit
fi

# OTHER PACKAGES: sudo apt-get -y install
cd /tmp
wget "$LOGSTASH_SERVER/dist/logstash-forwarder_0.3.1_amd64.deb"
dpkg -i logstash-forwarder_0.3.1_amd64.deb

mkdir -p /etc/logstash/private/
mkdir -p /etc/logstash/certs/
wget "$LOGSTASH_SERVER/dist/server.crt" -P /etc/logstash/certs/
wget "$LOGSTASH_SERVER/dist/server.key" -P /etc/logstash/private/
wget "$LOGSTASH_SERVER/dist/logstash-forwarder.conf" -P /etc/init/
wget "$LOGSTASH_SERVER/dist/logstash-forwarder.json" -P /etc/

server.conf

input {
  lumberjack {
    # The port to listen on
    port => 5043

    # The paths to your ssl cert and key
    ssl_certificate => "/etc/logstash/certs/server.crt"
    ssl_key => "/etc/logstash/ssl/private/server.key"

    # Set this to whatever you want.
    type => "somelogs"
  }
}