Log Courier is a lightweight tool created to ship log files speedily and securely, with low resource usage, to remote Logstash instances.
Table of Contents generated with DocToc
Log Courier is compatible with most Logstash versions with a single exception.
>=7.4.0and<7.6.0use a version of JRuby that has a bug making it incompatible and causes log-courier events to stop processing after an indeterminable amount of time (see #370) - please upgrade to 7.6.0 which updates JRuby to a compatible version.
There are many breaking changes in the configuration between 1.8 and 2.x. Please check carefully the list of breaking changes here: Change Log.
Packages also now default to using a log-courier user. If you require the old
behaviour of root, please be sure to modify the /etc/sysconfig/log-courier
(CentOS/RedHat) or /etc/default/log-courier (Ubuntu) file.
- Logstash Integration
- Read from a file or the program input (
stdin) - Follow log file rotations and movements
- Compliment log events with extra fields
- Reload configuration without restarting
- Transmit securely using TLS with server and (optionally) client verification
- Monitor shipping speed and status with the Administration utility
- Pre-process events on the sender using codecs (e.g. Multiline, Filter)
- At-least-once delivery of events to the Logstash pipeline - a Log Courier crash should never lose events
- Be efficient, reliable and scalable
- Keep resource usage low
- Be easy to use