@scottalanmiller said in Starting Clean - Kibana:
Looking through the old threads on this that I can find, the first mention of Filebeat was by @DustinB3403 and that's what sent us down this path, not someone suggesting it (as far as I can tell.) Then he posted on the Filebeat article, which firmed up this path even more. Then in this thread, there was no talk of anything else.
So that Filebeat wasn't the right tool was never really considered because Filebeat was injected from the beginning. That's what led to the crazy confusion.
So a new thread all about using rsyslog to send to Logstash in ELK is what is needed. And the issue appears to be that ELK was never configured to accept syslog files because it's not open by default to listen for them.
And mentioning Kibana doesn't help. KIbana is the K in ELK, but it's not a part that processes logs. You can use Kibana for other things too, like just showing system graphs.
Yeah I get the whole Kibana wasn't where the problem was - but this was because Dustin (and I) didn't understand where the error was.
The simple setup Dustin did - install Kiwi syslog server, change the XS log config file to send all logs to the Kiwi syslog server (took less than 10 mins) was so brain dead simple, neither of us knew what was failing in ELK. So Dustin started troubleshooting at the point he had direct contact with, Kibana.