TCP input

[morganchristiansson]

Was investigating logzoom for a usecase where I have json data sent via TCP and saw that it's not on the list of inputs.

File input would also be cool, potentially making this a log collector. :-)

edit: added mention of tcp to body

[asemt]

@morganchristiansson There's another tool exactly for that, it's called filebeat which is part of the Elastic Stack. Filebeat uses the lumberjack v2 protocol to transfer messages to logstash for which logzoom is a lightweight replacement and therefore also accepts messages coming in over the lumberjack v2 protocol. So it goes like this:

      +-----------------+            +------------+                +-----------+
      |                 |            |            |                |           |
      | JSON log files  +------------>  filebeat  +---------------->  logzoom  |
      |                 |            |            |                |           |
      +-----------------+            +------------+                +-+------+--+
                                                                     |      |
                                                                     |      |
                                                                     |      |
                                                                     |      |
                                      +----------------+             |      |
                                      |                |             |      |
                                      |  ElasticSearch <-------------+      |
                                      |                |                    |
                                      +----------------+                    |
                                                                            |
                                      +----------------------+              |
                                      |                      |              |
                                      |  AWS S3 object store <--------------+
                                      |                      |
                                      +----------------------+

[morganchristiansson]

filebeat only reads from files, not tcp streams. sorry if that wasn't clear.