# Connect Render.com Log Stream to Elastic Cloud

**URL:** <https://discuss.elastic.co/t/connect-render-com-log-stream-to-elastic-cloud/319704>\
**Category:** Logs\
**Created:** [November 24, 2022, 6:41am UTC](https://discuss.elastic.co/t/connect-render-com-log-stream-to-elastic-cloud/319704 "2022-11-24T06:41:59Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Mike\_Cann](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mike_cann/32/113707_2.png) [@Mike\_Cann](https://discuss.elastic.co/u/Mike_Cann)\
**Post date:** [November 24, 2022, 6:41am UTC](https://discuss.elastic.co/t/connect-render-com-log-stream-to-elastic-cloud/319704/1 "2022-11-24T06:41:59Z")

</div>

Hi I would like to push my logs from [Render.com](http://Render.com) so that they are viewable / tailable etc in Elastic Cloud.

[Render.com](http://Render.com) sends to a syslog drain ([Log Streams | Render · Cloud Hosting for Developers](https://render.com/docs/log-streams)) in a standard ([RFC5424](https://tools.ietf.org/html/rfc5424)) way.

Any ideas on how to connect the two?

---

<div class="post-metadata">

**Author:** ![Jenny\_Pavlova](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jenny_pavlova/32/111651_2.png) [@Jenny\_Pavlova](https://discuss.elastic.co/u/Jenny_Pavlova)\
**Post date:** [November 28, 2022, 3:47pm UTC](https://discuss.elastic.co/t/connect-render-com-log-stream-to-elastic-cloud/319704/2 "2022-11-28T15:47:53Z")

</div>

Hello @Mike_Cann,  
you can use [Filebeat](https://www.elastic.co/guide/en/beats/filebeat/8.5/filebeat-input-syslog.html#filebeat-input-syslog) to connect your logs to the Elastic Cloud.  
Another option is [logstash](https://www.elastic.co/guide/en/logstash/8.5/plugins-outputs-syslog.html#_description_109). They both support RFC5424 standard.  
Let me know if that works in your case.

---

<div class="post-metadata">

**Author:** ![Mike\_Cann](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mike_cann/32/113707_2.png) [@Mike\_Cann](https://discuss.elastic.co/u/Mike_Cann)\
**Post date:** [November 29, 2022, 12:30am UTC](https://discuss.elastic.co/t/connect-render-com-log-stream-to-elastic-cloud/319704/3 "2022-11-29T00:30:59Z")

</div>

Thankyou Jenny, so I can just point it at a Logstash URL and expect it to work?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [November 29, 2022, 1:07am UTC](https://discuss.elastic.co/t/connect-render-com-log-stream-to-elastic-cloud/319704/4 "2022-11-29T01:07:53Z")

</div>

Probably not as Logstash/Filebeat won't know the format of the events, so you will need to use grok or similar to parse them.

---

<div class="post-metadata">

**Author:** ![weltenwort](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/weltenwort/32/53885_2.png) [@weltenwort](https://discuss.elastic.co/u/weltenwort)\
**Post date:** [November 29, 2022, 10:46am UTC](https://discuss.elastic.co/t/connect-render-com-log-stream-to-elastic-cloud/319704/5 "2022-11-29T10:46:06Z")

</div>

There are useful facilities in the tools for parsing the syslog format:

- filebeat has a [syslog processor](https://www.elastic.co/guide/en/beats/filebeat/current/syslog.html)
- logstash's [grok processor](https://www.elastic.co/guide/en/logstash/7.5/plugins-filters-grok.html) comes with [syslog-related patterns](https://github.com/logstash-plugins/logstash-patterns-core/blob/main/patterns/ecs-v1/linux-syslog) built in
- the Elasticsearch ingest processor also supports these grok patterns

---

<div class="post-metadata">

**Author:** ![Mike\_Cann](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mike_cann/32/113707_2.png) [@Mike\_Cann](https://discuss.elastic.co/u/Mike_Cann)\
**Post date:** [December 1, 2022, 11:59pm UTC](https://discuss.elastic.co/t/connect-render-com-log-stream-to-elastic-cloud/319704/6 "2022-12-01T23:59:26Z")

</div>

Okay thanks. I guess I have some docs reading to do then 😉

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 30, 2022, 12:00am UTC](https://discuss.elastic.co/t/connect-render-com-log-stream-to-elastic-cloud/319704/7 "2022-12-30T00:00:14Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
