To send messages from syslog-ng OSE to Elasticsearch, complete the following steps.

Steps:

  1. Download and install the Java Runtime Environment (JRE), 2.x (or newer). The syslog-ng OSEelasticsearch2 destination is tested and supported when using the Oracle implementation of Java. Other implementations are untested and unsupported, they may or may not work as expected.

  2. NOTE: This step is only required if you use the elasticsearch2 destination in node mode or transport mode.

    Download the Elasticsearch libraries (version 2.x or newer from the 2.x line) from https://www.elastic.co/downloads/elasticsearch.

  3. NOTE: This step is only required if you use the elasticsearch2 destination in node mode or transport mode.

    Extract the Elasticsearch libraries into a temporary directory, then collect the various .jar files into a single directory (for example, /opt/elasticsearch/lib/) where syslog-ng OSE can access them. You must specify this directory in the syslog-ng OSE configuration file. The files are located in the lib directory and its subdirectories of the Elasticsearch release package.