rsyslog forwarder seems not not work

Question

I would like to send rsyslog message to my ELK stack but it does not work rsyslog conf

*.* @@127.0.0.1:10514
local6.*    /tmp/grenard.log
&~

logstash conf

input {
        syslog {                 
           port => 10514
           type => "syslog"
        }
        stdin {}
}

output {
  stdout { codec => rubydebug } 
}

logstash listens really on 10514 (telnet localhost 10514 )(test with a localhost telent 10514 and I can see it in my stdout

root@VM-GUILLAUME /etc/logstash/conf.d # /opt/logstash/bin/logstash -f /etc/logstash/conf.d Settings: Default filter workers: 4 Logstash startup completed { "message" => "bonjour\r\n", "@version" => "1", "@timestamp" => "2016-03-01T10:55:41.488Z", "type" => "syslog", "host" => "0:0:0:0:0:0:0:1", "tags" => [ [0] "_grokparsefailure_sysloginput"

Moreover, the logfile is fulfilled so I know my rsyslog conf is OK

logger -t apache -i -p local6.info $(date)

the log file

Mar 1 12:06:04 localhost apache[13700]: mar. mars 1 12:06:04 CET 2016

glmrenard glmrenard · Accepted Answer · 2016-03-03T12:43:05

Problem was due to tcp (@@). using udp (@) problem solved. Here my rsyslod.d/grenard.conf

*.* @127.0.0.1:10514
local6.*        /tmp/grenard.log

&~

rsyslog forwarder seems not not work

1 Answers