Collect Network Device Data - Req Keep Raw and Feed Into Elastic

Elastic Stack Logstash
1

I have ELK running on a single server at this point in time. I also have rsyslog server running on this same host.

We have many network devices (Cisco Switches Routers/ASA's/etc.) in our environment. My requirement is that I need to gather data from all network devices, and store them in a centralized location. The 2nd requirement, is that the network admin require that the raw data/files be retained for historical purposes.

My question is: Can LogStash meet both of these requirements (Collecting and Storing the raw syslog files being sent from the devices on the local server AND parsing the logs and feeding them into Elastic)? Or, should I simply collect the log files on the host using rsyslog, and then point LogStash to the local files and have it parse them? My goal is to be as efficient as possible with getting data into Elastic AND storing the raw log files for historical reference.

I hope I have explained this well, and I certainly appreciate any comments/feedback.

Kind Regards,
Jeff

2

Yes it can. Almost*.

*When it processes events it adds a timestamp (of the time that it was received), and the hostname of the LS host to that event, along with the original event data. So it is not just the raw event.

3

How would one go about getting access to the raw data?

4

You'd need to copy it before it hit LS.