Skip to content

Commit

Permalink
Update changelog and configuration
Browse files Browse the repository at this point in the history
  • Loading branch information
driskell committed Oct 20, 2021
1 parent d8c643e commit 952aa4e
Show file tree
Hide file tree
Showing 2 changed files with 11 additions and 78 deletions.
4 changes: 3 additions & 1 deletion CHANGELOG.md
Original file line number Diff line number Diff line change
@@ -1,6 +1,8 @@
# Change Log

## 2.7.0 (Future)
## 2.7.0

21st October 2021

Log Courier / Log Carver

Expand Down
85 changes: 8 additions & 77 deletions docs/LogstashIntegration.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,81 +3,29 @@
- [Logstash Integration](#logstash-integration)
- [Overview](#overview)
- [Installation](#installation)
- [Logstash Plugin Manager](#logstash-plugin-manager)
- [Manual installation](#manual-installation)
- [Local-only Installation](#local-only-installation)
- [Configuration](#configuration)

## Overview

Log Courier is built to work seamlessly with [Logstash](http://logstash.net). It
communicates via an input plugin called "courier".

An output plugin is also available to allow Logstash instances to communicate
with each other using the same reliable and efficient protocol as Log Courier.
(NOTE: An output plugin exists for Logstash to Logstash transmission but is archived
and no longer maintained and its use is not advised.)

## Installation

### Logstash Plugin Manager

Logstash 1.5 introduces a new plugin manager that makes installing additional
plugins extremely easy.

Simply run the following commands as the user Logstash was installed with to
install the latest stable version of the Log Courier plugins. If you are only
receiving events, you only need to install the input plugin.

cd /path/to/logstash
bin/plugin install logstash-input-courier
bin/plugin install logstash-output-courier

Once the installation is complete, you can start using the plugins!

*Note: If you receive a Plugin Conflict error, try updating the zeromq output
plugin first using `bin/plugin update logstash-output-zeromq`*

### Manual installation

For Logstash 1.4.x the plugins and dependencies need to be installed manually.

First build the Log Courier gem the plugins require. The file you will need will
be called log-courier-X.X.gem, where X.X is the version of Log Courier you have.

git clone https://github.com/driskell/log-courier
cd log-courier
make gem

Switch to the Logstash installation directory as the user Logstash was installed
with and install the gem. Note that because this is JRuby it may take a minute
to finish the install. The ffi-rzmq-core and ffi-rzmq gems bundled with Logstash
will be upgraded during the installation, which will require an internet
connection.
install the latest stable version of the Log Courier plugin.

cd /path/to/logstash
export GEM_HOME=vendor/bundle/jruby/1.9
java -jar vendor/jar/jruby-complete-1.7.11.jar -S gem install /path/to/the.gem

The remaining step is to manually install the Logstash plugins.

cd /path/to/log-courier
cp -rvf lib/logstash /path/to/logstash/lib

### Local-only Installation
./bin/logstash-plugin install logstash-input-courier

If you need to install the gem and plugins on a server without an internet
connection, you can download the gem dependencies from the rubygems site and
transfer them across. Follow the instructions for Manual Installation and
install the dependency gems first using the same instructions as for the Log
Courier gem.

- <https://rubygems.org/gems/ffi-rzmq-core>
- <https://rubygems.org/gems/ffi-rzmq>
- <https://rubygems.org/gems/multi_json>
Once the installation is complete, you can start using the plugin!

## Configuration

The 'courier' input and output plugins will now be available. An example
configuration for the input plugin follows.
The 'courier' input plugin will now be available. An example configuration follows.

input {
courier {
Expand All @@ -87,7 +35,7 @@ configuration for the input plugin follows.
}
}

The following options are available for the input plugin:
The following options are available:

- transport - "tcp", "tls", "plainzmq" or "zmq" (default: "tls")
- address - Interface address to listen on (defaults to all interfaces)
Expand All @@ -100,26 +48,9 @@ The following options are available for the input plugin:
(tls)
- ssl_verify_ca - Path to an SSL CA certificate to use for client certificate
verification (tls)
- curve_secret_key - CurveZMQ secret key for the server (zmq)
- min_tls_version - Sets the minimum TLS version when transport is "tls", defaults to 1.2, minimum is 1.0 and maximum 1.3
- max_packet_size - The maximum packet size to accept (default 10485760,
corresponds to Log Courier's `"spool max bytes"`)
- peer_recv_queue - The size of the internal queue for each peer
- add_peer_fields - Add "peer" field to events that identifies source host, and
"peer_ssl_dn" for TLS peers with client certificates

The following options are available for the output plugin:

- addresses - Address to connect to in array format (only the first address will
be used at the moment)
- port - Port to connect to
- ssl_ca - Path to SSL certificate to verify server certificate
- ssl_certificate - Path to client SSL certificate (optional)
- ssl_key - Path to client SSL private key (optional)
- ssl_key_passphrase - Password for ssl_key (optional)
- spool_size - Maximum number of events to spool before a flush is forced
(default 1024)
- idle_timeout - Maximum time in seconds to wait for a full spool before
flushing anyway (default 5)

NOTE: The tcp, plainzmq and zmq transports are not implemented in the output
plugin at this time. It supports only the tls transport.

0 comments on commit 952aa4e

Please sign in to comment.