Logstash 1.4.1+ Collectd configuration

logstash-1-collectd.conf

# This is the simplest definition, with the addition of a type
input {
  udp {
    port => 25826         # Must be specified. 25826 is the default for collectd
    buffer_size => 1452   # Should be specified. 1452 is the default for recent versions of collectd
    codec => collectd { } # This will invoke the default options for the codec
    type => "collectd"
  }
}

logstash-2-collectd-signed.conf

# This adds the definitions necessary to sign collectd messages with the credentials in collectd.auth
input {
  udp {
    port => 25826
    buffer_size => 1452
    codec => collectd {
      authfile => "/usr/local/etc/collectd.auth"
      security_level => "Sign"
    }
    type => "collectd"
  }
}

logstash-3-collectd-encrypted.conf

# This adds the definitions necessary to encrypt collectd messages with the credentials in collectd.auth
input {
  udp {
    port => 25826
    buffer_size => 1452
    codec => collectd {
      authfile => "/usr/local/etc/collectd.auth"
      security_level => "Encrypt"
    }
    type => "collectd"
  }
}

logstash-4-collectd-tuned.conf

# This example shows how to modify worker and queue_size count
input {
  udp {
    port => 25826
    buffer_size => 1452
    workers => 3          # Default is 2
    queue_size => 30000   # Default is 2000
    codec => collectd { }
    type => "collectd"
  }
}

Hi @untergeek, thanks for the excellent gists! 😄 👍

Can you clarify what benefit is gained by using the udp plugin with collectd codec over the collectd plugin? I am currently using the collectd plugin thus:

input {
  collectd {
  }
}

output {
  elasticsearch {
    protocol => "http"
    host => "my_es_cluster.foo"
  }
}

and every message gets tagged with _grokparsefailure, even though I am not using any filters at all on the collectd messages. Do you know if your method above would remedy this?

@longshiptech It's about performance and a better design. See this blog post.