Data Ingestion with Logstash

In the last example, we used Logstash to ingest log data from network devices. Let's build on that example and add a few more configuration changes in network_config/config_2.cfg:

input {
  udp {
    port => 5144
    type => "syslog-core"
  }
  udp {
    port => 5145
    type => "syslog-edge"
  }
}
filter {
 if [type] == "syslog-edge" {
    grok {
      match => { "message" => ".*" }
      add_field => [ "received_at", "%{@timestamp}" ]
    }
  } 
}
output {
  stdout { codec => json }
  elasticsearch {
    hosts => ["https://192.168.2.126:9200"]
    <skip>
  }
}

In the input section, we will listen on two UDP ports, 5144 and 5145. When the logs are received, we will tag the log entries with either syslog-core or syslog-edge. We will also add a filter section to the configuration to specifically...