# How to send Cisco devices logs to Logstash?

**URL:** <https://discuss.elastic.co/t/how-to-send-cisco-devices-logs-to-logstash/207132>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [November 8, 2019, 3:03pm UTC](https://discuss.elastic.co/t/how-to-send-cisco-devices-logs-to-logstash/207132 "2019-11-08T15:03:04Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![PraveenKT](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/praveenkt/32/35483_2.png) [@PraveenKT](https://discuss.elastic.co/u/PraveenKT)\
**Post date:** [November 8, 2019, 3:03pm UTC](https://discuss.elastic.co/t/how-to-send-cisco-devices-logs-to-logstash/207132/1 "2019-11-08T15:03:04Z")

</div>

Hi,

I want to send the Cisco switch logs to ELK stack? Is below procedure correct ?

step-1  
Sentd logs from Cisco switch to Rsyslog server

Step-2  
Install filebeat on Rsyslog server

Step-3: enable Filbeat Cisco module

Step-4: create Filebeat CIsco piplines

Step-4: send logs from filebeat to Logstash

Please correct me if i am wrong. If is there any another process please let me know.

---

<div class="post-metadata">

**Author:** ![exekias](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/exekias/32/28718_2.png) [@exekias](https://discuss.elastic.co/u/exekias)\
**Post date:** [November 13, 2019, 11:18am UTC](https://discuss.elastic.co/t/how-to-send-cisco-devices-logs-to-logstash/207132/2 "2019-11-13T11:18:34Z")

</div>

Hi @PraveenKT,

That approach would work. although you don't really need the Rsyslog server. Filebeat has a syslog input that can receive logs. Just enable the module and configure it's syslog input to listen on 0.0.0.0 (to receive from the network).

Best regards

---

<div class="post-metadata">

**Author:** ![VamPikmin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vampikmin/32/22367_2.png) [@VamPikmin](https://discuss.elastic.co/u/VamPikmin)\
**Post date:** [November 13, 2019, 11:56am UTC](https://discuss.elastic.co/t/how-to-send-cisco-devices-logs-to-logstash/207132/3 "2019-11-13T11:56:32Z")

</div>

I’ve found with filebeat you can send output to

1. elasticsearch
2. logstash (and eventually es)

With option one you can install the filebeat es pipeline that will parse the syslog properly. If you go with logstash you have to create your own patterns or just have everything in the message field  
Please correct me if I’m wrong

You can also not use filebeat at all and use logstash input to ingest logs and output those to es

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 11, 2019, 11:56am UTC](https://discuss.elastic.co/t/how-to-send-cisco-devices-logs-to-logstash/207132/4 "2019-12-11T11:56:33Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.