log-courier

README

Log Courier

Log Courier is a lightweight tool created to ship log files speedily and securely, with low resource usage, to remote Logstash instances.

Table of Contents generated with DocToc

• Upgrading to 2.x
• Features
• Philosophy
• Documentation
  • Installation
  • Reference

Upgrading to 2.x

There are many breaking changes in the configuration between 1.8 and 2.x. Please check carefully the list of breaking changes here: Change Log.

Packages also now default to using a log-courier user. If you require the old behaviour of root, please be sure to modify the /etc/sysconfig/log-courier (CentOS/RedHat) or /etc/default/log-courier (Ubuntu) file.

Features

• Logstash Integration
• Read from a file or the program input (stdin)
• Follow log file rotations and movements
• Compliment log events with extra fields
• Reload configuration without restarting
• Transmit securely using TLS with server and (optionally) client verification
• Monitor shipping speed and status with the Administration utility
• Pre-process events on the sender using codecs (e.g. Multiline, Filter)

Philosophy

• At-least-once delivery of events to the Logstash pipeline - a Log Courier crash should never lose events
• Be efficient, reliable and scalable
• Keep resource usage low
• Be easy to use

Documentation

Installation

• Public Repositories
• Building from Source

Reference

• Administration Utility
• Command Line Arguments
• Configuration
• Logstash Integration
• SSL Certificate Utility
• Change Log