Log Courier
Log Courier is a lightweight tool created to ship log files speedily and
securely, with low resource usage, to remote Logstash
instances.
Table of Contents generated with DocToc
Compatible Logstash Versions
Log Courier is compatible with most Logstash versions with a single exception.
>=7.4.0and<7.6.0use a version of JRuby that has a bug making it incompatible
and causes log-courier events to stop processing after an indeterminable amount
of time (see #370) - please upgrade to 7.6.0 which updates JRuby to a compatible
version.
Upgrading to 2.x
There are many breaking changes in the configuration between 1.8 and 2.x. Please
check carefully the list of breaking changes here:
Change Log.
Packages also now default to using a log-courier user. If you require the old
behaviour of root, please be sure to modify the /etc/sysconfig/log-courier
(CentOS/RedHat) or /etc/default/log-courier (Ubuntu) file.
Features
- Logstash Integration
- Read from a file or the program input (
stdin) - Follow log file rotations and movements
- Compliment log events with extra fields
- Reload configuration without restarting
- Transmit securely using TLS with server and (optionally) client verification
- Monitor shipping speed and status with the
Administration utility - Pre-process events on the sender using codecs
(e.g. Multiline, Filter)
Philosophy
- At-least-once delivery of events to the Logstash pipeline - a Log Courier
crash should never lose events - Be efficient, reliable and scalable
- Keep resource usage low
- Be easy to use