Connect Render.com Log Stream to Elastic Cloud

[Mike_Cann]

Hi I would like to push my logs from Render.com so that they are viewable / tailable etc in Elastic Cloud.

Render.com sends to a syslog drain (Log Streams | Render · Cloud Hosting for Developers) in a standard (RFC5424) way.

Any ideas on how to connect the two?

[Jenny_Pavlova]

Hello @Mike_Cann,
you can use Filebeat to connect your logs to the Elastic Cloud.
Another option is logstash. They both support RFC5424 standard.
Let me know if that works in your case.

[Mike_Cann]

Thankyou Jenny, so I can just point it at a Logstash URL and expect it to work?

[warkolm (Mark Walkom)]

Probably not as Logstash/Filebeat won't know the format of the events, so you will need to use grok or similar to parse them.

[weltenwort (Felix Stürmer)]

There are useful facilities in the tools for parsing the syslog format:

• filebeat has a syslog processor
• logstash's grok processor comes with syslog-related patterns built in
• the Elasticsearch ingest processor also supports these grok patterns

[Mike_Cann]

Okay thanks. I guess I have some docs reading to do then