Syslog nach Graylog senden

Journalbeat installieren

sudo apt install journalbeat

Journalbeat konfigurieren (vi /etc/journalbeat/journalbeat.yml)

logging.level: info
logging.to_files: true
logging.files:
        path: /var/log/journalbeat
        name: journalbeat
        keepfiles: 7
        permissions: 0644
journalbeat.inputs:
- paths: []
  seek: head
output.logstash:
  # Boolean flag to enable or disable the output module.
  enabled: true
  ssl.enabled: false  
  # Graylog host and the beats input
  hosts: ["127.0.0.1:5044"]

Beat input in Graylog konfigurieren

Journalbeat starten

systemctl start journalbeat
systemctl enable journalbeat
systemctl status journalbeat