While we would usually prefer sending data from a every server directly to Sophie, in some cases we would want to setup a relay. Most commonly, that would be the case with older network devices and operating systems that do not support encryption.

Note: we also have a guide for setting up an Rsyslog relay

When already using Filebeat to ship logs to Sophie, doubling its role as a relay is simple and encouraged.

Start by adding the following input to the Filebeat configuration file:

filebeat.inputs:
- type: tcp
  max_message_size: 10MiB
  host: "localhost:{{inbound-port}}"

 Replace {{inbound-port}}  with the port you will be sending data to this server

Similar to other inputs (such as file inputs) you can add fields that will be used as hints by Sophie to determine the application, service, and source-type of the events:

filebeat.inputs:
- type: tcp
  ...
  fields:
    loom-application: IBM-AIX

Save the configuration and restart Filebeat for the changes to take effect.

That's it! the relay is ready. Start sending the logs to the relay to see them forwarded to Sophie. The data will be wrapped by the relay in a Filebeat header.

Did this answer your question?