Multiple Syslog Sources Configuration on Single Elastic Agent Port, port 514

Elastic Stack Elastic Agent
1

Current Setup:

  • Elastic Agent collecting syslog messages from:
    • Aruba access points and switches (Custom UDP integration)
    • F5 VPN (Custom UDP integration)
    • Fortigate firewalls (Fortigate Syslog integration)
  • All configured to use port 514
  • Single Elastic Agent instance

Issue:
All syslog messages are being processed only by the Fortigate Syslog integration, while the custom UDP integrations for Aruba and F5 are being bypassed completely.

Question:
What's the recommended approach to configure multiple syslog sources (Aruba, F5, Fortigate) on a single Elastic Agent using the same port (514)? Looking for a solution that doesn't require setting up different ports for each system.

Additional Context:

  • Need to maintain standard syslog port (514)
  • Prefer to keep single agent configuration
  • Require proper message routing to respective integrations
2

Hello and welcome,

You cannot have multiple integrations listening on the same port, each integration is a different process and you cannot bind different processes to the same port.

It is required to use a different port for each integration.

If you cannot change the port and need to use 514 you need something to reroute the events to the correct integration.

Depending on the version of the stack you are, there is a new integration called Syslog Router that can do that, it has some pre-configured patterns to reroute to the correct integration, but you can also add extra patterns. This integration requires version 8.14.3 or higher and it is still in beta.

You can also do this reroute using rsyslog, in this case you would need to configure each integration with a different internal port and in rsyslog you could direct the logs to each integration based on the source or some other logic.

3

Thanks Leandro, that's very helpful! I'm wondering if I have these integrations on different agent instances but still with the same port, so essentially I'm gonna switch to a multi-agent setup, will it solve this problem?

4

If by different instances you mean completely different machines/VMs, then you will have no issues as the agents would be running on different places.

5

Also, are you using Fleet Managed or Standalone agents?

If you are using Fleet Managed, you would need one policy per agent.

6

Yes, that's great to hear. Exactly, I mean by different VMs.

7

It's standalone agents