Free tools Windows power users keep installed
One-click scans. No signup required.
The dependable pattern is a three-tier pipeline: rsyslog collects events, Logstash parses and enriches them, and Elasticsearch indexes them for search. Forward from rsyslog to a Logstash TCP input for stateful delivery; add TLS when logs may contain credentials, personal data, or security telemetry. Use UDP only when occasional loss is acceptable. Keep queues at pipeline boundaries, authenticate Logstash to Elasticsearch over HTTPS, and test outage recovery before sending production traffic.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
What the centralized architecture looks like
Rsyslog is the collection and routing layer. It can read local sockets, systemd journals, files, and network syslog, then apply rulesets before taking an action. Its documented mental model is inputs → rulesets → actions. Inputs receive messages, rulesets classify or transform them, and actions write locally, forward remotely, or send to an Elasticsearch cluster.
As an Amazon Associate I earn from qualifying purchases.
Logstash is the processing tier. An input accepts the stream from rsyslog, filters parse the original message, enrichment adds fields such as environment or site, and an Elasticsearch output writes normalized documents. Elasticsearch stores and indexes those documents so operators can search by host, service, severity, timestamp, or any field you preserve.
A typical deployment is:
Linux hosts and network devices
│
▼
rsyslog collectors (journal, socket, file, network syslog)
│ TCP or UDP, preferably TLS where required
▼
Logstash input → filters → Elasticsearch output
│
▼
Elasticsearch indices and lifecycle policiesCollectors
Run rsyslog on each Linux host, or place it on an edge collector for devices that cannot run an agent. A host can collect its own journal and applications while an edge instance listens for network syslog. Keep collection close to the source so a temporary WAN or processing outage does not prevent local capture.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
Transport
Rsyslog forwards selected events to a Logstash TCP or UDP listener. TCP creates a stateful connection and is the normal choice when delivery matters. UDP has lower protocol overhead but no connection-level delivery guarantee; use it only for event classes where loss is an accepted trade-off. Add TLS when the path crosses an untrusted network or the contents are sensitive.
Processing and storage
Logstash should turn heterogeneous messages into a predictable document shape before indexing. Elasticsearch then receives authenticated HTTPS requests and stores the resulting documents in an index or rollover-managed data stream. Decide naming, retention, shard sizing, and rollover rules before volume grows; changing them after ingestion can require reindexing.
Recommended Free Tools
When to bypass Logstash
Rsyslog can write directly to Elasticsearch through its omelasticsearch action. Direct output has fewer moving parts and can be appropriate when messages already have the required structure and need little enrichment. The extra Logstash tier earns its operational cost when you need centralized parsing, conditional routing, enrichment, a common schema for many senders, or an additional buffering and failure boundary.
| Design | Best fit | Trade-offs |
|---|---|---|
| Rsyslog → Elasticsearch | Small, homogeneous deployments with simple routing | Fewer components, but parsing and enrichment remain distributed in rsyslog configuration |
| Rsyslog → Logstash → Elasticsearch | Many sources, changing formats, enrichment, routing, or controlled back-pressure | More moving parts and another service to secure, monitor, and scale |
Plan the pipeline before installing it
Classify event sources
List the facilities, applications, network devices, and files that must be retained. Record the original hostname, program or service name, facility, severity, source address, and event timestamp. If an application emits JSON, preserve the original payload until parsing has been validated; if it emits free text, identify stable delimiters or patterns.
Set retention and sensitivity requirements
Retention may differ by event class: security telemetry often needs a longer period than routine debug output. Identify credentials, personal data, tokens, and regulated fields before forwarding. This decision determines whether the transport needs TLS, who may search the indices, and which fields should be masked or dropped.
Choose failure behavior
Decide what happens when Logstash or Elasticsearch is unavailable. A collector can queue locally and retry, discard low-value events, or block a sender. Blocking may protect delivery but can also fill disks or stall applications that write synchronously to syslog. Make the policy explicit for each class instead of relying on defaults.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
Configure rsyslog inputs, rulesets, and actions
The main configuration file is /etc/rsyslog.conf. Put host-specific or site-specific snippets in /etc/rsyslog.d/*.conf so package upgrades do not force you to edit the main file. Keep input declarations, rulesets, and actions in separate sections; this makes it clear where a message enters, how it is classified, and where it goes.
Enable local inputs
Use imuxsock for the local Unix socket, imjournal for systemd journal ingestion, and imfile for applications that write ordinary files. Do not enable two modules for the same source without understanding duplicate behavior. For file inputs, define a stable state file and an identity for each monitored file so restarts do not reread the entire file.
module(load="imuxsock")
module(load="imjournal")
module(load="imfile")
input(type="imfile"
File="/var/log/myapp/app.log"
Tag="myapp"
Facility="local6"
Severity="info")Module parameters vary by rsyslog version and distribution packaging. Validate the syntax on the target host rather than copying a configuration intended for another release.
Receive network syslog when required
For network senders, load imtcp or imudp and bind a dedicated port. Use a separate ruleset for network traffic so remote messages cannot accidentally follow local catch-all actions.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallmodule(load="imtcp")
input(type="imtcp" port="514" ruleset="from_network")
module(load="imudp")
input(type="imudp" port="514" ruleset="from_network")Do not expose both protocols simply because they are available. Open only the listener that matches your senders and firewall policy. If confidentiality or delivery guarantees are required, use the rsyslog TLS configuration for the listener and sender, with certificates and trust anchors managed like any other production credential.
Define a narrow forwarding ruleset
Forward only the facilities, severities, hosts, or programs that belong in the central stream. A narrowly scoped rule prevents noisy debug traffic or unrelated local files from consuming queue and index capacity.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
ruleset(name="to_logstash") {
if ($syslogfacility-text == "local6") then {
action(
type="omfwd"
target="logstash.internal.example"
port="5044"
protocol="tcp"
queue.type="LinkedList"
queue.filename="to-logstash"
action.resumeRetryCount="-1"
)
}
}The exact queue and retry parameters should reflect your disk budget and outage policy. Keep a local copy or diagnostic action while commissioning the pipeline so you can compare what rsyslog received with what Logstash parsed. Once the rule is proven, remove temporary duplication to avoid indexing the same event twice.
Use TLS with deliberate directive order
Rsyslog’s TLS central-server guidance relies on directive order: certificate, key, trust, and listener settings must appear in the sequence expected by the documented configuration. Treat that order as functional, not cosmetic. Restrict private-key permissions, define the trusted certificate authority, verify hostnames where supported, and plan certificate rotation before the first certificate expires.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Build the Logstash pipeline
Choose a TCP or UDP input
Create one input that matches the rsyslog action. TCP is appropriate for a connection-oriented stream; UDP is useful only when the sender and event class tolerate loss. Use a distinct port or pipeline for each materially different protocol or message format so a parser never has to guess whether framing is reliable.
input {
tcp {
port => 5044
codec => line
}
}
filter {
mutate {
add_field => { "pipeline_source" => "rsyslog" }
}
}
output {
elasticsearch {
hosts => ["https://es01.internal.example:9200"]
index => "logs-%{+YYYY.MM.dd}"
user => "${ES_USER}"
password => "${ES_PASSWORD}"
ssl_certificate_authorities => ["/etc/logstash/certs/ca.crt"]
}
}The example establishes the shape of a pipeline; replace the host, port, index policy, and credentials with values for your environment. Keep secrets in the Logstash keystore or protected environment settings rather than committing them to a pipeline file.
Parse and normalize fields
Start by preserving the raw message and then extract stable fields. Common normalized fields include @timestamp, host.name, log.level, service.name, event.dataset, and a source address. Use a parser suited to the format: JSON decoding for JSON, a delimiter-aware parser for fixed separators, and Grok only when patterns are stable and tested against representative samples.
Apply the date in the message when it is trustworthy, while retaining the ingestion time for delay analysis. If parsing fails, add a parse-error tag and route the original event to a diagnostic index or file. Do not silently drop malformed events; an apparently empty dashboard can otherwise hide a parser regression.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
Prevent accidental index explosions
Do not create index names from unbounded values such as a user-agent string or arbitrary program text. Use a controlled pattern based on event class, environment, and date or rollover policy. Map fields deliberately, especially identifiers that may have inconsistent types across senders. A field that is a number in one event and a string in another can create mapping conflicts that stop indexing.
Secure Logstash-to-Elasticsearch delivery
Elasticsearch clusters are secured by default starting in version 8.0. Configure the Logstash output for HTTPS, authenticate with a dedicated principal, and grant only the index privileges that the pipeline needs. Elastic documentation notes that the Logstash Elasticsearch input, output, and filter plugins support authentication and encryption over HTTPS.
Authentication and authorization checklist
- Create a service identity for Logstash instead of using an administrator account.
- Grant write, create, and rollover privileges only for the intended log indices or data streams.
- Grant template or lifecycle privileges separately if Logstash must manage them; otherwise manage those objects through deployment automation.
- Store the username, password, API key, and keystore passphrase outside source control.
- Install the correct certificate authority and verify the Elasticsearch hostname presented by the certificate.
- Test an intentional authentication failure in a non-production environment so operators recognize the resulting Logstash error.
A failed Elasticsearch authentication stops successful delivery from that output. Monitor the Logstash pipeline for blocked or retrying outputs and alert before queues consume the available disk.
Queues, outages, and horizontal scale
Queues buffer work between stages. Rsyslog can queue messages while a forwarding action is unavailable, and Logstash can use persistent queues so events survive a process restart. The rsyslog pipeline-stage documentation describes queues as the buffer between stages: rsyslog pipeline stages and queues.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Rsyslog queue choices
- In-memory queue: low latency, but queued events disappear when the process or host loses power.
- Disk-assisted or disk queue: protects against longer outages, at the cost of disk space and write overhead.
- Bounded queue: makes disk use predictable, but requires a policy for what happens when it fills.
Choose queue limits from the event rate and the longest outage you intend to absorb. There is no universal throughput number: message size, filters, storage, network conditions, and Elasticsearch topology change the result. Measure on the target environment instead of importing a benchmark from another system.
Logstash persistent queues and groups
Enable persistent queues when losing events during a Logstash restart is unacceptable, and place the queue on storage sized for the planned outage window. For higher volume or maintenance events, run horizontally scalable Logstash instances behind a distribution method that preserves the protocol and failure behavior you require. Ensure each instance has identical filters, credentials, mappings, and dead-letter or diagnostic handling.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Elasticsearch retention and rollover
Retention is an operational control, not merely a storage setting. Set lifecycle rules that move or delete indices according to the event class, and monitor shard count, disk watermarks, and rollover frequency. Keep hot data sized for the searches operators actually run; retaining every debug event indefinitely can crowd out security and incident data.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Implement the deployment in a controlled sequence
- Define event classes. Document sources, required fields, sensitivity, retention, and the accepted loss policy for each class.
- Install and enable rsyslog. Confirm the service starts at boot, then place host-specific rules in
/etc/rsyslog.d/. Validate configuration before restarting. - Create the Logstash input. Bind the chosen TCP or UDP port to the expected interface and restrict access with host firewalls or network policy.
- Add a narrowly scoped rsyslog action. Forward one facility, host group, or test tag first. Confirm that the sender can connect and that the listener receives complete messages.
- Build filters incrementally. Preserve raw content, parse one source format at a time, normalize timestamps and fields, and route failures to a diagnostic path.
- Configure the Elasticsearch output. Set HTTPS, the certificate authority, service credentials, index permissions, and a controlled index or data-stream name.
- Enable buffering and monitoring. Add rsyslog queues, Logstash persistent queues where required, disk alerts, pipeline throughput and error monitoring, and Elasticsearch health alerts.
- Exercise failure cases. Stop Elasticsearch, stop Logstash, rotate a certificate, introduce a malformed event, skew a source clock, and restart each service. Verify retries, queue growth, recovery, duplicate behavior, and index rollover.
Verification and troubleshooting
No events leave the host
- Run the rsyslog configuration validator supplied by your distribution before restarting the service.
- Confirm the application writes to the socket, journal, or file that the selected input actually reads.
- Check facility, severity, hostname, and program filters; a rule that is too narrow can look like a transport failure.
- Inspect the rsyslog service log and queue statistics for syntax errors, permission problems, or a full queue.
Rsyslog connects but Logstash shows nothing
- Verify the destination address and port from the collector, then check host and network firewalls.
- Make sure protocol and framing match: a TCP sender must reach a TCP input, and a UDP sender must reach a UDP input.
- Check whether a TLS listener is receiving plaintext or a plaintext listener is receiving a TLS handshake.
- Send a single unmistakable test message and follow it through the input, filter, and output rather than testing with a noisy production stream.
Logstash receives messages but Elasticsearch rejects them
- Read the output error for authentication, certificate validation, authorization, mapping, or connectivity clues.
- Confirm the service identity can write to the selected index and that index templates do not assign incompatible field types.
- Check the certificate authority path, hostname verification, and system clock on the Logstash host.
- Route malformed documents to a diagnostic destination so one bad event does not disappear silently.
Duplicates or missing events appear after recovery
Retries can produce duplicates when a sender cannot tell whether the remote side committed an event before a connection dropped. Decide whether downstream deduplication is required and preserve a stable event identifier where the source provides one. For missing events, compare the source’s local record, rsyslog queue counters, Logstash input and filter counters, and Elasticsearch rejected-document metrics. This stage-by-stage comparison identifies the first point of loss instead of treating the whole stack as one black box.
Timestamps are wrong
Check source clock synchronization, timezone parsing, and whether the filter overwrites the event timestamp. Keep ingestion time alongside the source timestamp so delayed delivery is visible. A clock-skew alert is valuable because incorrect timestamps affect retention, dashboards, and incident timelines simultaneously.
Operational practices that keep the system healthy
- Monitor collector disk usage, queue depth, forwarding retries, and local write errors.
- Monitor Logstash pipeline throughput, worker utilization, persistent-queue growth, filter failures, and output retries.
- Monitor Elasticsearch cluster health, disk watermarks, rejected writes, shard count, and lifecycle execution.
- Review certificate expiry and rotate certificates before they become an outage.
- Version-control rsyslog snippets and Logstash pipelines, with peer review for changes to filters and index mappings.
- Document the owner, retention, sensitivity, and loss policy for every event class.
- Use a canary source that emits a known event so end-to-end alerts detect a broken pipeline before an incident does.
Choosing between TCP, UDP, and TLS
| Choice | Use when | Risk or cost |
|---|---|---|
| UDP | Very low overhead is important and occasional loss is acceptable | No connection-level delivery guarantee; packets can be dropped or reordered |
| TCP | Events are operationally important and a stateful stream is acceptable | Connections, back-pressure, and stalled peers must be monitored |
| TCP plus TLS | Logs cross trust boundaries or contain credentials, personal data, or security telemetry | Certificate issuance, trust-store management, rotation, and handshake troubleshooting add work |
Make this decision per source or event class, not as a blanket preference. A low-value debug stream may tolerate UDP while authentication failures or audit records require a reliable, encrypted path.
What success looks like
A production-ready deployment has a clear source-to-index path, narrowly scoped forwarding, deterministic parsing, authenticated HTTPS to Elasticsearch, bounded queues, and alerts for every stage. It also has a documented response when a queue fills, a certificate expires, a parser fails, or Elasticsearch is unavailable. The architecture is simple enough to trace one event from its originating host to its indexed document, yet separated enough that collection, processing, and storage can be secured and scaled independently.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problems
