log-courier

README

Log Courier

Log Courier is a lightweight tool created to ship log files speedily and securely, with low resource usage, to remote Logstash instances.

Table of Contents generated with DocToc

• Log Courier
  • Compatible Logstash Versions
  • Upgrading to 2.x
  • Features
  • Philosophy
  • Documentation
    • Installation
    • Reference

Compatible Logstash Versions

Log Courier is compatible with most Logstash versions with a single exception.

• >=7.4.0 and <7.6.0 use a version of JRuby that has a bug making it incompatible and causes log-courier events to stop processing after an indeterminable amount of time (see #370) - please upgrade to 7.6.0 which updates JRuby to a compatible version.

Upgrading to 2.x

There are many breaking changes in the configuration between 1.8 and 2.x. Please check carefully the list of breaking changes here: Change Log.

Packages also now default to using a log-courier user. If you require the old behaviour of root, please be sure to modify the /etc/sysconfig/log-courier (CentOS/RedHat) or /etc/default/log-courier (Ubuntu) file.

Features

• Logstash Integration
• Read from a file or the program input (stdin)
• Follow log file rotations and movements
• Compliment log events with extra fields
• Reload configuration without restarting
• Transmit securely using TLS with server and (optionally) client verification
• Monitor shipping speed and status with the Administration utility
• Pre-process events on the sender using codecs (e.g. Multiline, Filter)

Philosophy

• At-least-once delivery of events to the Logstash pipeline - a Log Courier crash should never lose events
• Be efficient, reliable and scalable
• Keep resource usage low
• Be easy to use

Documentation

Installation

• Public Repositories
• Building from Source

Reference

• Administration Utility
• Command Line Arguments
• Configuration
• Logstash Integration
• SSL Certificate Utility
• Change Log