# Logs received from panorama **URL:** \ **Category:** Logstash\ **Created:** [January 10, 2024, 7:08pm UTC](https://discuss.elastic.co/t/logs-received-from-panorama/350785 "2024-01-10T19:08:11Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![juancamiloll](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/juancamiloll/32/110326_2.png) [@juancamiloll](https://discuss.elastic.co/u/juancamiloll)\ **Post date:** [January 10, 2024, 7:08pm UTC](https://discuss.elastic.co/t/logs-received-from-panorama/350785/1 "2024-01-10T19:08:11Z")
Hello everyone, Normally when I do the ELK installation I ask the firewall administrators to send the logs via port 514 TPC to the server I administer. In the server what I do is that I modify the [rsyslog.com](http://rsyslog.com) file to open the 514 ports and at the end I add a line so that the logs that I detect coming in are stored in a folder with system-xxxxxx/YYYYY/MM/DD format. Then by means of logstash yml file called panos.conf I specify the path of each one of the logs that I am receiving, this way I have worked without problem. But in this case the admin of the firewall insists on sending the logs of all the firewalls through Panorama, the problem I have is that my server detects the IP of panorama or the host name and I only get 1 .log file that stores the logs of all the sources and I don't know if Logstash is able to process so much information. What opinions do you have? What do you recommend? ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [January 10, 2024, 8:37pm UTC](https://discuss.elastic.co/t/logs-received-from-panorama/350785/2 "2024-01-10T20:37:41Z")
Are you moving to having multiple files to one single file on an existing system or is this a new system? Personally I do not like this approach of receiving with syslog, writing to a file and reading from that file, I prefer to send the logs directly from the firewall to logstash using an UDP or TCP input as this will use less I/O and less CPU in my experience. As an example, I have a couple of high rate network devices where I use the following infrastructure to receive the logs: Device --\> LB --\> Logstash (2 nodes) --\> Kafka Cluster --\> Logstash (N nodes) --\> Elasticsearch But you could use something like this: Device --\> Logstash UDP/TCP --\> Elasticsearch ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [January 10, 2024, 8:41pm UTC](https://discuss.elastic.co/t/logs-received-from-panorama/350785/3 "2024-01-10T20:41:25Z")
> [@juancamiloll](#): > > I don't know if Logstash is able to process so much information. I think that it would depend on the event rate. I had some issues in the past where Logstash could not read the file fast enough, and then the file rotates and some events were lost or duplicated. I stopped using Logstash to read files a couple of years, to read files I use Filebeat in some cases or vectordev from Datadog in other cases. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 7, 2024, 8:41pm UTC](https://discuss.elastic.co/t/logs-received-from-panorama/350785/4 "2024-02-07T20:41:57Z")
Closed on February 7, 2024, 8:41pm UTC This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.