Logging to remote server "elk stack"

[Mohammad Ramadan A.Hafiez]

Hi friends,

   I have been tasked to implement open source logging server and forward all switches and routers..etc logs to it.

I have made it building elk stack 4.5 on ubuntu server 16 and working well but...

My issue that all received logs have the same severity of 5 and facility which is not correct according to the received logs.

Any one could make it before to help me? Any ideas guys?

Thank you all in advance

M.R.

[Lewis Goulden · Accepted solution]

Hi, 

You need to edit your Logstash configuration, and filter input using grok.

I have set up ELK in the past and found some useful configurations online.

Take a look at this configuration for cisco devices. (ASA is slightly different due to log format)

https://gist.github.com/clay584/5a75009ad571af3d0648

[Mohammad Ramadan A.Hafiez]

Hi Lewis,

             Thank you so much for your help, I figured out what was the issue and handled it , beside you link helped me too.

this link helped me too http://grokdebug.herokuapp.com/

thank you again

[Romeo]

Hello did you follow a guide that you can share for all the installing process?

thanks in advance and best regards!

[akjain3]

Hi,

I need to visualize logs of the switch through elk but I need help to figure it out. Can you help me with that?

Thanks in advance

[Georg Pauwen]

Hello,

as I understand it, you have to create a dashboard in order to visualize data (Step 4 in the page linked below). Is that what you are looking for ?

https://www.redhat.com/sysadmin/web-server-monitor-ELK

[akjain3]

Yes, I want to visualize the data and find out the failure points easily i.e. anomaly detection. But Frist can you help me to figure out how can I send logs from the server to Elasticsearch through Logstash.

[Georg Pauwen]

Hello,

check the link below for the Logstash part. Is that what you are looking for ?

https://www.neteye-blog.com/2017/10/sending-cisco-syslogs-to-elasticsearch-a-simple-guide/