iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
The most flexible pattern is a three-tier pipeline: rsyslog collects local, file, journal, and network events; Logstash parses, enriches, and routes them; Elasticsearch indexes the resulting documents for search and retention. Use TCP (and TLS when logs are sensitive or must not be exposed) between rsyslog and Logstash, protect the Logstash-to-Elasticsearch connection with HTTPS, a trusted certificate authority, credentials, and narrowly scoped index privileges, and add queues before production load.
Rsyslog can also write directly to Elasticsearch with its omelasticsearch action. That path is simpler, but inserting Logstash is worthwhile when several sources need common parsing, enrichment, routing, or an independent buffering layer.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteThe pipeline to build
Rsyslog’s documented mental model is inputs → rulesets → actions. Inputs receive messages, rulesets classify or transform them, and actions write locally, forward remotely, or send to a destination such as Elasticsearch. Queues can buffer work between stages. A central design applies that model at the edge and then gives Logstash responsibility for document processing.
- Collectors: rsyslog runs on each Linux host or on one or more edge collectors. It reads the system journal, local sockets, files, and network syslog.
- Transport: rsyslog forwards only the events you select to a Logstash TCP or UDP input. Choose the transport deliberately; the choice affects loss, latency, confidentiality, and recovery behavior.
- Processing: Logstash receives the event, parses the original syslog payload, adds fields such as host or environment, and sends a normalized document to Elasticsearch.
- Storage and search: Elasticsearch stores and indexes the documents. Its security settings govern Logstash authentication, HTTPS, certificate trust, and index permissions.
Keep collection and processing separate when you expect different teams to operate them, need to scale parsing independently, or want a buffer during Elasticsearch maintenance. A small environment can collapse tiers, but the same inputs, rulesets, actions, filters, and security decisions still apply.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
Choose the transport before writing configuration
| Transport | Use it when | Trade-offs |
|---|---|---|
| UDP | Loss is acceptable and minimum protocol overhead is the priority, for example low-value telemetry on a controlled network. | Connectionless delivery provides no session-level recovery. Packets can be dropped during congestion or an outage, and the sender normally cannot know which messages arrived. |
| TCP | You need a stateful connection and a better delivery guarantee than UDP provides. | Connections consume resources and can stall while a receiver is unavailable. Add rsyslog queues and retry behavior so a temporary failure does not immediately discard messages. |
| TCP with TLS | Messages may contain credentials, personal data, or security telemetry, or the network between collector and Logstash is not fully trusted. | Certificate issuance, trust stores, hostname validation, rotation, and troubleshooting become operational requirements. The protection is usually worth the work for production security logs. |
Elastic’s syslog guidance describes rsyslog sending to Logstash TCP or UDP endpoints. Rsyslog also documents TCP/TLS delivery and a TLS-secured central-server pattern. Whichever protocol you select, document what happens when Logstash is down: whether rsyslog queues to disk, drops after a limit, or blocks a producer.
Plan event classes, retention, and trust boundaries
Before installing anything, write down which events you need and how long each class must remain searchable. Authentication records, firewall events, application diagnostics, and high-volume access logs rarely have identical retention or access requirements.
Free tools Windows power users keep installed
One-click scans. No signup required.
- Classify sources: list hosts, network devices, applications, facilities, severities, and file paths. Decide which messages are forwarded and which remain local.
- Define fields: agree on names for timestamp, hostname, facility, severity, program, source address, environment, and any application identifiers. Consistent names make dashboards and alerts portable.
- Set sensitivity: identify secrets, personal information, and security telemetry. These categories normally require TLS in transit and restricted Elasticsearch roles.
- Set retention and rollover: choose searchable and archive periods, index naming, rollover triggers, and deletion rules before ingesting data. Retention drives disk, shard, and backup requirements.
- Map failure domains: decide whether collectors, Logstash workers, and Elasticsearch nodes are separate failure domains and how many copies of each tier you require.
Install and organize rsyslog
Most Linux distributions ship rsyslog or make it available from their standard repositories. Install the package using your distribution’s package manager, enable the service, and confirm it starts cleanly. The primary configuration is /etc/rsyslog.conf; keep host- or role-specific rules in /etc/rsyslog.d/*.conf so they can be reviewed and deployed independently.
Use the modules that match your sources:
imuxsockreceives messages from the local Unix socket.imjournalreads the systemd journal. Do not enable overlapping journal and socket ingestion without a plan for duplicate records.imfiletails application or appliance files. Define rotation behavior and an identity for each file so a rotated file is not reread unexpectedly.imtcpandimudplisten for network syslog. Bind only to the interfaces and ports that should accept senders, and restrict them with host firewalls or network policy.
Validate every change with the rsyslog configuration test mode supplied by your distribution before restarting the service. Then check the service journal and send a known test event through the intended ruleset.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
Example network listeners
The following is a starting pattern, not a universal port assignment. Replace the example ports and ruleset name with values from your design:
# /etc/rsyslog.d/10-network-inputs.conf
module(load="imudp")
input(type="imudp" port="514" ruleset="network_to_logstash")
module(load="imtcp")
input(type="imtcp" port="514" ruleset="network_to_logstash")Listening on both protocols is useful during a migration, but it also makes it easy to receive duplicates when an upstream device is configured twice. Record the source protocol in your inventory and select one forwarding path per sender.
Example forwarding ruleset with a queue
This example forwards messages from the named ruleset to a Logstash TCP listener and keeps retrying while the destination is unavailable. Queue sizing, disk location, and retry policy must be calculated for your outage window and available storage.
# /etc/rsyslog.d/60-forward-to-logstash.conf
ruleset(name="network_to_logstash") {
action(
type="omfwd"
target="logstash.internal.example"
port="5514"
protocol="tcp"
action.resumeRetryCount="-1"
queue.type="LinkedList"
queue.filename="network-to-logstash"
)
}
# Forward selected local messages as well
if ($syslogfacility-text == "authpriv" or $syslogseverity-text == "err") then {
action(
type="omfwd"
target="logstash.internal.example"
port="5514"
protocol="tcp"
action.resumeRetryCount="-1"
queue.type="LinkedList"
queue.filename="local-to-logstash"
)
}Use a disk-assisted or otherwise persistent queue when losing messages during a restart is unacceptable. A memory-only queue protects against short stalls but cannot survive a process or host failure. Keep local fallback files for critical classes if policy requires an additional copy.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
Add TLS without hiding certificate order
Rsyslog’s TLS central-server documentation warns that directive order matters. Put global certificate-authority and driver settings before the module and input directives that use them, and keep the listener’s authentication and permitted-peer settings together. The exact parameter names differ by rsyslog release and TLS driver, so copy the syntax for the installed version and verify it with the configuration test command. On the Logstash side, require a certificate whose name matches the endpoint and install the issuing CA on every collector.
Configure the Logstash pipeline
Give each pipeline a narrow purpose. A basic syslog pipeline has an input, optional filters, and an Elasticsearch output. Use separate pipelines when one source needs expensive parsing or a different failure policy.
input {
tcp {
port => 5514
codec => line {}
}
# Enable only if UDP loss is an explicit design choice.
udp {
port => 5515
codec => line {}
}
}
filter {
# Parse RFC-style priority and timestamp when present.
syslog_pri { }
date {
match => [ "timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss", "ISO8601" ]
target => "@timestamp"
}
mutate {
add_field => { "pipeline" => "syslog" }
}
# Add source-specific grok, JSON, or key/value parsing here.
}
output {
elasticsearch {
hosts => [ "https://es01.internal.example:9200" ]
index => "logs-%{+YYYY.MM.dd}"
user => "${ES_LOGSTASH_USER}"
password => "${ES_LOGSTASH_PASSWORD}"
ssl_certificate_authorities => [ "/etc/logstash/certs/ca.crt" ]
}
}Plugin option names change across Logstash generations, especially for TLS-enabled inputs. Treat the snippet as a structure to adapt to the installed plugin documentation: verify whether the release expects ssl_enabled or an older SSL option, the certificate and key paths, and the current authentication fields.
Parse, normalize, and quarantine bad events
Start with the least destructive parser. Preserve the original message in a field such as event.original before applying grok, JSON, or key/value extraction. Add tags when parsing fails, and route those events to a diagnostic index or file instead of silently dropping them. Include the collector name, source address, protocol, and ingestion timestamp so operators can distinguish a malformed sender from a broken parser.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
Normalize timestamps carefully. Syslog messages without a year rely on the collector’s clock and timezone; incorrect clocks can place events in the wrong day’s index. Keep the original timestamp text when it matters for forensic review, and monitor clock synchronization on hosts, collectors, Logstash workers, and Elasticsearch nodes.
Secure the Logstash-to-Elasticsearch connection
Elasticsearch clusters are secured by default starting in version 8.0. Logstash therefore needs an authenticated HTTPS connection rather than an anonymous HTTP output. Elastic documentation states that the Elasticsearch input, filter, and output plugins support authentication and encryption over HTTPS.
- Create a service identity for Logstash rather than using an administrator account.
- Grant that identity only the index, data-stream, template, and lifecycle privileges required by your deployment. Separate write privileges from human read or administration roles.
- Set the Elasticsearch output hosts to
https://and configure the certificate-authority file that issued the cluster certificate. - Store the username and password in Logstash’s protected keystore or an equivalent secret manager; do not commit credentials to pipeline files.
- Verify hostname validation and certificate expiration from every Logstash worker. A trusted CA alone is not a substitute for checking the endpoint name.
- Test a deliberate authentication failure in a non-production environment. Logstash should stop or report the output failure rather than continue as if documents were safely indexed.
When certificates rotate, install the new CA or chain before replacing the server certificate, reload or restart components according to their supported procedure, and remove obsolete trust material only after every client has migrated.
Choose between Logstash and direct rsyslog output
| Design | Advantages | Costs and limits | Best fit |
|---|---|---|---|
| Rsyslog → Logstash → Elasticsearch | Central parsing and enrichment, multiple output routes, diagnostics for malformed events, and independent scaling of collection and processing. | More services, credentials, certificates, queues, and failure domains to operate. | Mixed Linux, network, and application sources; teams that need common schemas or complex routing. |
Rsyslog → Elasticsearch with omelasticsearch |
Fewer moving parts and lower configuration overhead for straightforward forwarding. | Parsing, enrichment, and branching logic stay in rsyslog; complex transformations can become harder to maintain. | Small deployments with simple, well-structured events and no need for a separate processing tier. |
Do not add Logstash merely because it is familiar. Add it when its filters, routing, buffering, or operational isolation solve a requirement that direct output cannot meet cleanly.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Make the pipeline resilient and scalable
Queues are buffers between rsyslog pipeline stages. Rsyslog’s stage documentation explains how queues decouple inputs, rulesets, and actions: read the rsyslog pipeline-stages documentation. Use the smallest queue that covers normal bursts, then calculate disk capacity for the longest outage you intend to absorb.
Rsyslog queues
- Use an in-memory queue for short interruptions where loss on process restart is acceptable.
- Use a disk-assisted or persistent queue when events must survive a restart or a prolonged Logstash outage.
- Set retry and resume behavior explicitly. An unbounded retry policy without disk monitoring can fill the filesystem.
- Alert on queue depth, age of the oldest message, enqueue failures, and available disk space.
Logstash persistence and horizontal scale
Elastic recommends horizontally scalable Logstash groups for higher volume and documents persistent queues for resiliency. Run multiple workers behind a stable endpoint or distribute senders across workers. Ensure every worker has the same filter, certificate, and secret configuration, and decide whether ordering matters for your event classes before load balancing.
Recommended Free Tools
There is no single safe throughput or latency number for this architecture. Message size, filter complexity, queue settings, network conditions, Elasticsearch mappings, shard layout, and hardware all change capacity. Measure in the target environment with representative events rather than copying a benchmark from another topology.
Elasticsearch storage policy
Size data nodes for the retention period, replica policy, shard count, and expected growth. Keep high-volume classes in separate index patterns or data streams when they need different rollover or access rules. Monitor rejected writes, indexing latency, disk watermarks, unassigned shards, and mapping failures. A green dashboard is not proof that every collector is delivering data; compare source-side counts with indexed counts.
Production implementation sequence
- Define requirements: document event classes, retention, sensitivity, acceptable loss, outage duration, and ownership for each tier.
- Install and enable rsyslog: keep shared settings in
/etc/rsyslog.confand host-specific rules in/etc/rsyslog.d/. Enable only the input modules you need. - Deploy Logstash input: create a TCP listener first unless your design explicitly accepts UDP loss. Restrict firewall access to known collectors and record the selected port.
- Add a narrow rsyslog rule: forward one facility, host group, or test file before forwarding all traffic. Confirm the event appears once in Logstash.
- Build filters: parse each source, preserve the original payload, normalize fields, and route malformed records to a diagnostic destination.
- Configure Elasticsearch output: use HTTPS, a CA file, a dedicated service identity, secret storage, and index privileges limited to the intended targets.
- Harden for production: add rsyslog queues, Logstash persistent queues where appropriate, disk and queue alerts, certificate-expiration monitoring, and an Elasticsearch retention policy.
- Exercise failure cases: stop Logstash, block Elasticsearch, rotate a certificate, skew a test clock, resend a duplicate, and force an index rollover in a non-production environment. Document observed recovery and any loss; do not assume a queue or retry setting behaves as intended until you have measured it.
Troubleshoot from the edge inward
| Symptom | Likely cause | Checks and corrective action |
|---|---|---|
| No events arrive at Logstash | Listener is disabled, firewall rules block the port, or rsyslog’s rule never matches. | Check the rsyslog service log, validate the active ruleset, verify that Logstash is listening on the expected address and port, and test connectivity from the collector. Send one tagged test event and trace it through each hop. |
| Events arrive twice | The same source is read through both imjournal and imuxsock, or a device sends both UDP and TCP copies. |
Inventory every input, disable the overlapping path, and add a stable event identifier or deduplication strategy where the sender can legitimately retry. |
| Messages wait in rsyslog queues | Logstash is unreachable, TLS negotiation fails, or the destination is rejecting connections. | Inspect queue depth and age, test DNS and TCP reachability, verify certificate names and CA files, and check the Logstash input log. Protect the filesystem from an unbounded queue. |
| Logstash reports authentication or authorization errors | Wrong secret, expired credential, untrusted CA, hostname mismatch, or missing index privilege. | Confirm the secret loaded by the running pipeline, inspect certificate validity, test the HTTPS endpoint with the configured CA, and grant only the required write and template permissions. |
| Documents are indexed but fields are wrong | Source formats differ, a date pattern is incorrect, or a grok/filter branch catches the wrong message. | Inspect the preserved original payload, add source-specific conditionals, send parse failures to quarantine, and test timestamps around timezone and year boundaries. |
| Elasticsearch rejects writes | Disk watermark, mapping conflict, unavailable shard, expired certificate, or insufficient privileges. | Read the exact rejection, then check cluster health, disk watermarks, mappings, shard allocation, output TLS logs, and the Logstash service role. |
Operational checks after launch
- Compare per-source send counts, rsyslog action counts, Logstash event metrics, and Elasticsearch indexed-document counts. Investigate unexplained gaps rather than relying on a single dashboard.
- Alert on queue growth, oldest queued-event age, Logstash persistent-queue utilization, pipeline failures, certificate expiry, Elasticsearch rejected writes, disk watermarks, and unassigned shards.
- Review retention and index growth regularly. Delete or archive data through the chosen lifecycle policy instead of manually removing active indices.
- Keep configuration, parser tests, certificate renewal steps, and rollback procedures in version control. Test a representative message whenever a filter or mapping changes.
- Restrict access to raw logs and secrets. Parsing can expose tokens or personal data even when the original sender was inside a trusted network.
A practical decision rule
Use direct rsyslog-to-Elasticsearch output for a small, low-complexity installation that can tolerate keeping parsing logic at the collector. Use the three-tier design when you need centralized enrichment, multiple destinations, independent scaling, or a controlled quarantine path for malformed events. In either case, choose TCP over UDP when delivery matters, add TLS for sensitive traffic, secure Elasticsearch with HTTPS and least-privilege credentials, and prove outage recovery with a test in your own environment.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →
