# Cisco IOS logging - help required **URL:** \ **Category:** Elasticsearch\ **Tags:** fleet, integrations\ **Created:** [May 4, 2022, 3:18pm UTC](https://discuss.elastic.co/t/cisco-ios-logging-help-required/303957 "2022-05-04T15:18:06Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![yelloyonder](https://avatars.discourse-cdn.com/v4/letter/y/5fc32e/32.png) [@yelloyonder](https://discuss.elastic.co/u/yelloyonder)\ **Post date:** [May 4, 2022, 3:18pm UTC](https://discuss.elastic.co/t/cisco-ios-logging-help-required/303957/1 "2022-05-04T15:18:06Z")
Hi, I'm trying to ingest IOS switch logs into Elasticsearch, but I feel like I'm missing out on how this all works (I'm not a network engineer which may explain it!) We're using Elastic cloud and Fleets Cisco IOS integration. I think what needs to happen is: 1. Setup a syslog service on server A. 2. Configure Cisco device to send syslog data to server A. 3. Install the Cisco IOS integration on to Server A 4. Logs are collected and appear in Elasticsearch. But I may have the wrong end of the stick with this. The Cisco IOS integration doesn't have many options, just the host and port. Any help would be appreciated! ---
**Author:** ![joshdover](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/joshdover/32/42020_2.png) [@joshdover](https://discuss.elastic.co/u/joshdover)\ **Post date:** [May 5, 2022, 10:12am UTC](https://discuss.elastic.co/t/cisco-ios-logging-help-required/303957/2 "2022-05-05T10:12:25Z")
If the logs are being written to disk on server A via syslog, you’ll need to use the system integration to collect them, however they wouldn’t be processed in a very useful format with this method since they won’t go through the Cisco IOS specific processing logic. We do have efforts underway to support this type of collection, but we have not yet released this. Alternatively you can configure the Cisco IOS integration running on Server A to connect directly to the Cisco device using host and port. Is this an option for you? ---
**Author:** ![yelloyonder](https://avatars.discourse-cdn.com/v4/letter/y/5fc32e/32.png) [@yelloyonder](https://discuss.elastic.co/u/yelloyonder)\ **Post date:** [May 5, 2022, 11:08am UTC](https://discuss.elastic.co/t/cisco-ios-logging-help-required/303957/3 "2022-05-05T11:08:10Z")
Hi Josh, Thanks for your reply. > Alternatively you can configure the Cisco IOS integration running on Server A to connect directly to the Cisco device using host and port. Is this an option for you? How would I configure this? The Integration only seems to allow the setting of IP and port, which I thought meant locally on the server with the integration installed? Currently I've configured it as follows: 1. Cisco device sends syslog data to Server A on port 514 2. Server A has Cisco IOS integration installed, set to listen on localhost:514 Confirmed Server A listening on port 514: ```auto COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME filebeat 2193 root 14u IPv4 1755263 0t0 UDP localhost:syslog ``` Forced Syslog data send from Cisco device, tcpdump in Server A shows traffic arriving from the Cisco device. But no data appears in Kibana. Checked agent logs, and the datastream isn't generated. Thanks, Jon ---
**Author:** ![cmenuey](https://avatars.discourse-cdn.com/v4/letter/c/5fc32e/32.png) [@cmenuey](https://discuss.elastic.co/u/cmenuey)\ **Post date:** [May 6, 2022, 8:31pm UTC](https://discuss.elastic.co/t/cisco-ios-logging-help-required/303957/4 "2022-05-06T20:31:32Z")
This may help, I noticed you had localhost in there, my datastream wouldn't ingest until I used the real IP of my agent host. Here's an example of what mine looks like(fake IP): ![example](https://us1.discourse-cdn.com/elastic/original/3X/d/a/da3f003a8dd2641aaf53bd4481348a4cd289d6a2.jpeg) ---
**Author:** ![yelloyonder](https://avatars.discourse-cdn.com/v4/letter/y/5fc32e/32.png) [@yelloyonder](https://discuss.elastic.co/u/yelloyonder)\ **Post date:** [May 11, 2022, 10:06am UTC](https://discuss.elastic.co/t/cisco-ios-logging-help-required/303957/5 "2022-05-11T10:06:05Z")
HI @cmenuey that did the trick thank you! ---
**Author:** ![cmenuey](https://avatars.discourse-cdn.com/v4/letter/c/5fc32e/32.png) [@cmenuey](https://discuss.elastic.co/u/cmenuey)\ **Post date:** [May 11, 2022, 2:04pm UTC](https://discuss.elastic.co/t/cisco-ios-logging-help-required/303957/6 "2022-05-11T14:04:03Z")
Just out of curiosity, do you get the Cisco dashboards now that you have the data coming in? I've attempted to use two different Cisco integrations and both pull in data, but neither give me a dashboard. ---
**Author:** ![yelloyonder](https://avatars.discourse-cdn.com/v4/letter/y/5fc32e/32.png) [@yelloyonder](https://discuss.elastic.co/u/yelloyonder)\ **Post date:** [May 11, 2022, 2:24pm UTC](https://discuss.elastic.co/t/cisco-ios-logging-help-required/303957/7 "2022-05-11T14:24:42Z")
Yes same as you, no dashboards or other assets are installed with the Cisco IOS integration (haven't used the others) ---
**Author:** ![cmenuey](https://avatars.discourse-cdn.com/v4/letter/c/5fc32e/32.png) [@cmenuey](https://discuss.elastic.co/u/cmenuey)\ **Post date:** [May 13, 2022, 6:44pm UTC](https://discuss.elastic.co/t/cisco-ios-logging-help-required/303957/8 "2022-05-13T18:44:44Z")
I'm not sure if this is the intended use of the integration, but I was able to find a way to use the data that comes in. If you navigate to Stack Management --\> Data --\> Index Management, you'll find that there are Indices, Data Streams, etc. built for the ios logs. For my data I had to create a Data View by going to Stack Management --\> Kibana --\> Data Views From there I created a data view by choosing advanced to find hidden Indexes, attached is a screenshot of what you could setup, after that you'll see the Data View available in Discovery, then you can use the fields to make dashboards. ![dataview](https://us1.discourse-cdn.com/elastic/original/3X/f/0/f07cb32f6cf1bd4ee33cefecf830e1d56f233da5.jpeg) ---
**Author:** ![yelloyonder](https://avatars.discourse-cdn.com/v4/letter/y/5fc32e/32.png) [@yelloyonder](https://discuss.elastic.co/u/yelloyonder)\ **Post date:** [May 16, 2022, 7:49am UTC](https://discuss.elastic.co/t/cisco-ios-logging-help-required/303957/9 "2022-05-16T07:49:30Z")
Thanks for the tip Christopher I'll take a look at that. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 13, 2022, 7:50am UTC](https://discuss.elastic.co/t/cisco-ios-logging-help-required/303957/10 "2022-06-13T07:50:28Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.