# Is this a valid setup for syslog, redis, logstash, elasticsearch, kibana?

**URL:** https://discuss.elastic.co/t/is-this-a-valid-setup-for-syslog-redis-logstash-elasticsearch-kibana/34229
**Category:** Elasticsearch
**Created:** [November 10, 2015, 10:02am UTC](https://discuss.elastic.co/t/is-this-a-valid-setup-for-syslog-redis-logstash-elasticsearch-kibana/34229 "2015-11-10T10:02:19Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![tomas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tomas/32/5698_2.png) [@tomas](https://discuss.elastic.co/u/tomas)
#### Post date: [November 10, 2015, 10:02am UTC](https://discuss.elastic.co/t/is-this-a-valid-setup-for-syslog-redis-logstash-elasticsearch-kibana/34229/1 "2015-11-10T10:02:19Z")

</div>

Hi all,  
I'd appreciate some input regarding my proposed setup. I'm pretty new to all of these products so I might have the wrong mindset. Please see the attached image.

Many thanks

 ![](https://us1.discourse-cdn.com/elastic/original/2X/2/2f82e61c1638d34935aae7d8f5de6a4fd572a6da.jpg)

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [November 10, 2015, 12:18pm UTC](https://discuss.elastic.co/t/is-this-a-valid-setup-for-syslog-redis-logstash-elasticsearch-kibana/34229/2 "2015-11-10T12:18:54Z")

</div>

I think it looks pretty reasonable. Any particular reason you want syslog-ng to receive the messages before handing them off to the shipper instance? How do the shippers decide which Redis instance to connect to?

---

<div class="post-metadata">

### Author: ![tomas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tomas/32/5698_2.png) [@tomas](https://discuss.elastic.co/u/tomas)
#### Post date: [November 10, 2015, 12:48pm UTC](https://discuss.elastic.co/t/is-this-a-valid-setup-for-syslog-redis-logstash-elasticsearch-kibana/34229/3 "2015-11-10T12:48:05Z")

</div>

Thanks Magnus  
hmm, didn't actually think about skipping syslog-ng all together?! So you mean logstash can recieve directly from the clients syslog?  
Regarding which redis I think I read somewhere you could configure the output to redis to be redundant?

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [November 10, 2015, 12:55pm UTC](https://discuss.elastic.co/t/is-this-a-valid-setup-for-syslog-redis-logstash-elasticsearch-kibana/34229/4 "2015-11-10T12:55:47Z")

</div>

> hmm, didn't actually think about skipping syslog-ng all together?! So you mean logstash can recieve directly from the clients syslog?

Sure, Logstash has a syslog input.

> Regarding which redis I think I read somewhere you could configure the output to redis to be redundant?

Oh, right. Yes, that's fine.

---

<div class="post-metadata">

### Author: ![tomas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tomas/32/5698_2.png) [@tomas](https://discuss.elastic.co/u/tomas)
#### Post date: [November 10, 2015, 2:55pm UTC](https://discuss.elastic.co/t/is-this-a-valid-setup-for-syslog-redis-logstash-elasticsearch-kibana/34229/5 "2015-11-10T14:55:16Z")

</div>

Aha, so I can just set up an syslog input and use the host and port instead of a file param to setup a listener?

Like this I guess

```
input {
  udp {
    port => 514
    type => syslog
  }
}

```

Thanks 😃

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 5, 2017, 11:39pm UTC](https://discuss.elastic.co/t/is-this-a-valid-setup-for-syslog-redis-logstash-elasticsearch-kibana/34229/6 "2017-07-05T23:39:26Z")

</div>