logstash-forwarder

However the # of sweeping changes this implies for to upgrade from logstash-forwarder makes me question whether the upgrade is even worth the trouble.

Also the logstash-forwarder is a pretty genius idea!

We used a central logstash server to receive the data from filebeat and logstash-forwarder running on multiple other servers.

I just spent today building logstash-forwarder into the image so we can view logs from all devices in real-time.

Re: logstash too heavy That's what logstash-forwarder[1] (formerly lumberjack) is for.

I'm now looking into log aggregation and centralisation with Logstash and logstash-forwarder (previously Lumberjack).

Interesting and looks like a very promising replacement to logstash-forwarder.

For a working example, have a look at the logstash-forwarder code structure, it's how they do it, and you can build that from any directory you want.

I used ELK to analyze my nginx logs, and it worked really well, and now that logstash-forwarder is replaced by Beats, its even more reliable.

We used to use a locally-hosted ELK stack, so yes, including ES as the data backend for Kibana, but there Logstash or more precisely filebeat and logstash-forwarder became the bottleneck.

My favourite thing about logstash-forwarder was that it was apparently an actual intentional design decision to shut the service down if none of the log files it was watching moved in 24 hours.

Sometimes the names are close enough to be Extremely annoying, like package name "logstash-forwarder" and /etc/rc.conf.d/logstash_forwarder.