ELK Stack and Journalctl
-
I was just messing around and noticed Fedora 22 doesn't have a /var/log/messages file or a /var/log/secure file.
I saw that you can edit /etc/systemd/journald.conf and have it output to syslog but I didn't seem to get it working. How do you output from journalctl to ELK?
-
Paging @scottalanmiller
-
I'm out traveling the country, but can dig into this later in the week.
-
Well I now have a /var/log/messages file and a /var/log/secure file, but they are still empty. Just an update.
-
After some more testing it seems enabling output to journald.conf has worked. I did restart it after I tried that but it didn't show up. Now it's working. Not sure what changed, but at least it's working.
