Coralogix provides a seamless integration with Logstash so you can send your logs from anywhere and parse them according to your needs.

Talbe of contents

1. Prerequisites
2. Usage
3. Installation
4. Configuration

Prerequisites

Have Logstash installed, for more information on how to install: https://www.elastic.co/guide/en/logstash/current/installing-logstash.html

Usage

Private Key - A unique ID which represents your company, this Id will be sent to your mail once you register to Coralogix..

Application Name - The name of your main application, for example, a company named “SuperData” would probably insert the “SuperData” string parameter or if they want to debug their test environment they might insert the “SuperData– Test”.

SubSystem Name - Your application probably has multiple subsystems, for example: Backend servers, Middleware, Frontend servers etc. in order to help you examine the data you need, inserting the subsystem parameter is vital.

Installation

logstash-plugin install logstash-output-coralogix_logger

If you are not sure where logstash-plugin is located, you can check here:

https://www.elastic.co/guide/en/logstash/current/dir-layout.html

Configuration

Open your Logstash configuration file and add Coralogix output. (You should configure input plugin depending on your needs, for more information regarding input plugins please refer to: https://www.elastic.co/guide/en/logstash/current/input-plugins.html)

output {
    coralogix_logger { 
        config_params => {
            "PRIVATE_KEY" => "11111111-1111-1111-1111-111111111111"
            "APP_NAME" => "Logstash Tester"
            "SUB_SYSTEM" => "Logstash subsystem"
        } 
        log_key_name => "message"
        is_json => true
    }
}   

The fist key (config_params) is mandatory while the other two are optional. In case your input stream is a JSON object, you can extract APP_NAME and/or SUB_SYSTEM from the JSON using the $ sign. For instance, in the bellow JSON $message.system will extract “nginx” value.

{
    "@timestamp": "2017 - 04 - 03 T18: 44: 28.591 Z",
    "@version": "1",
    "host": "test-host",
    "message": {
        "system": "nginx",
        "status": "OK",
        "msg": "Hello from Logstash"
    }
}

In case your input stream is a JSON object and you don’t want to send the entire JSON, rather just a portion of it, you can write the value of the key you want to send in the log_key_name. By default, logstash will put your raw log message in the "message" key.

For instance, in the above example, if you write log_key_name message then only the value of message key will be sent to Coralogix. If you do want to send the entire message then you can just delete this key.

In case your raw log message is a JSON object you should set is_json key to a "true" value, otherwise you can ignore it.

Restart Logstash.