Adding Unique Server IP to log-courier CFG?

[ninjada]

Hello,

Using log-courier with a lot of autoscale group servers on AWS. Each autoscale group will have x servers with the same name eg. prod-web, prod-varnish etc.

All well & good, but occasionally it's handy to identify the exact server in logstash and it gets a bit tricky, as they will all have the same 'host' id.

I figure I'd need to create a unique extra field. My log-courier setup is part of the bootstrap for all servers on deploy, so I could populate some field with the server ip-address in the log-courier cfg.

What would be the best method to include an extra field with say the originating server ip? The docs has the host field value, but I'm not sure on a practical example of how to implement this on the config.

Current cfg example:

{
  "network": {
    "servers": [ "logs.internal.dns:5000" ],
    "timeout": 15,
    "ssl ca": "/etc/pki/tls/certs/ssl.crt"
  },
  "general": {
    "log file": "/var/log/log-courier/log-courier.log",
    "log level": "error"
  },
  "files" : [
    {
      "paths" : [
        "/var/log/messages",
        "/var/log/secure"
       ],
      "fields": { "type" : "syslog" }
    },
    {
      "paths" : [
        "/var/log/nginx/access.log"
        ],
      "fields": { "type" : "nginx-access" }
    }
  ]
}

[driskell]

Hello

Usually with AWS auto scaling the hostname is not changed and it then defaults to one relating to the private address so it is unique per server instance.

You could try adding add_peer_fields => true to the Logstash courier input though. That will tag every event with a peer field containing the originating IP and port of the log-courier connection. If you are using client certificates it also drops the client certificate common name into peer_ssl_cn

Jason

[ninjada]

Oh great, just what i needed. Didn't think about it from the logstash input end 👍