Configuration
This article will guide you through configuring the Logship agent.
The agent can collect data from sources such as Windows performance counters, ETW providers, and journalctl logs, among others. The configuration is done through a JSON file called "appsettings.json", which is watched for updates.
You can find an example configuration in the agent source on Github.
Output
endpoint
- Description: The HTTP endpoint to which data will be shipped. You may also use
"console"
to summarize collected data in the console, rather than uploading. - Type: string
- Required: Yes
interval
- Description: The interval at which data will be pushed to the endpoint.
- Type: string
- Required: No
maximumBufferSize
- Description: The maximum size of the agent buffer in number of events. Events will be dropped if reached.
- Type: int
- Required: No
{
"endpoint": "console",
"interval": "00:00:02",
"maximumBufferSize": 15000
}
Inputs
The input configuration section of the Logship agent JSON file is an array that specifies the various sources from which log and performance data is collected. Each input type is represented as an object within the array and must include a required "type"
field that specifies the type of input to collect. Additional fields that are specific to the input type can be included in the object to fine-tune its behavior.
type
- Description: The input type.
- Type: string
- Required: Yes
[...] Extended Data
- Object properties can differ between input types
[ {
"type": "HealthService"
},{
"type": "Windows.PerformanceCounters",
"interval": "00:00:05",
"counters": [
"\\Process(*)\\*logship*"
]
}, ...other inputs...]
In this example, the "Windows.PerformanceCounters" input type includes an "interval" field that determines how frequently the counters are monitored, as well as a "counters" field that specifies which performance counters to collect.
Available inputs
Type | Description | Notes |
---|---|---|
HealthService | Collects data from a health service. | |
Windows.PerformanceCounters | Collects data from Windows performance counters. | Windows |
Windows.Etw | Collects data from Windows ETW providers. | Windows |
JournalCtl | Collects data from journalctl logs. | Linux |
HealthService Input
Field | Required | Description |
---|---|---|
type | Yes | The input type. Must be "HealthService". |
interval | Yes | The frequency at which to collect data from the health service. |
{
"type": "HealthService",
"interval": "00:00:05.000"
}
This input type collects data from a health service and includes an "interval" field that determines how frequently the data is collected.
Windows.PerformanceCounters Input
Field | Required | Description |
---|---|---|
type | Yes | The input type. Must be "Windows.PerformanceCounters". |
interval | Yes | The frequency at which to collect performance counter data. |
counters | Yes | An array of strings specifying the performance counters to collect. |
{
"type": "Windows.PerformanceCounters",
"interval": "00:00:05",
"counters": [
"\\Process(*)\\*logship*"
]
}
This input type collects data from Windows performance counters and includes an "interval" field that determines how frequently the counters are monitored. The "counters" field is an array that specifies which performance counters to collect.
Windows.Etw Input
Field | Required | Description |
---|---|---|
type | Yes | The input type. Must be "Windows.Etw". |
cleanupOldSessions | No | A boolean indicating whether to clean up old ETW sessions before starting a new one. |
reuseExistingSession | No | A boolean indicating whether to reuse an existing ETW session with the same configuration. |
providers | Yes | An array of objects specifying the ETW providers to collect data from. Each object must include a "ProviderGuid" field with the GUID of the provider to collect data from. |
{
"type": "Windows.Etw",
"cleanupOldSessions": true,
"reuseExistingSession": false,
"providers": [
{
"ProviderGuid": "AE4BD3BE-F36F-45B6-8D21-BDD6FB832853"
},
{
"ProviderGuid": "4d1b58e1-1220-542a-815b-41707a19672d"
},
{
"ProviderGuid": "7f006a22-73fb-4c17-b1eb-0a3070f9f187"
},
{
"ProviderGuid": "E6F378E8-21CE-49A9-8D98-1BAAF053AB51"
},
{
"ProviderGuid": "EA289C62-8C36-4904-9726-15ECD282AED5"
}
]
}
This input type collects data from Windows ETW providers and includes fields such as "cleanupOldSessions" and "reuseExistingSession" that determine how the ETW session is managed. The "providers" field is an array that specifies which ETW providers to collect data from.
JournalCtl Input
Field | Required | Description |
---|---|---|
type | Yes | The input type. Must be "JournalCtl". |
flags | No | An integer specifying which journalctl flags to use when collecting logs. |
columns | No | An array of strings specifying which columns to include in the output. |
{
"type": "JournalCtl",
"flags": 0,
"columns": ["USERID"]
}
This input type collects data from journalctl logs and includes a "flags" field that specifies which journalctl flags to use when collecting logs, and a "columns" field that specifies which columns to include in the output.