# My first centralized log server **URL:** \ **Category:** Logstash\ **Created:** [August 23, 2020, 1:50am UTC](https://discuss.elastic.co/t/my-first-centralized-log-server/246002 "2020-08-23T01:50:35Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![leostereo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leostereo/32/74891_2.png) [@leostereo](https://discuss.elastic.co/u/leostereo)\ **Post date:** [August 23, 2020, 1:50am UTC](https://discuss.elastic.co/t/my-first-centralized-log-server/246002/1 "2020-08-23T01:50:35Z")
Hi guys , im learning elk. Just asking for some advices building my first loggin server. I need to gather al logs incoming from my mikrotik devices. Question is: What do I need to accomplish that ? (I already have my basic elk installed and working). Single logstash + kibana setting ? Any light on this would wellcome for reading. Regards. ---
**Author:** ![ylasri](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ylasri/32/86120_2.png) [@ylasri](https://discuss.elastic.co/u/ylasri)\ **Post date:** [August 23, 2020, 9:44am UTC](https://discuss.elastic.co/t/my-first-centralized-log-server/246002/2 "2020-08-23T09:44:18Z")
Where mikrotik devices save logs ? You have first to identifiy data source and format, then see how you can ingest them into elasticsearch (using beats or logstash, or any integration with any broker), then Yes kibana to visualize the data If you could provide more details on your use case ? ---
**Author:** ![leostereo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leostereo/32/74891_2.png) [@leostereo](https://discuss.elastic.co/u/leostereo)\ **Post date:** [August 23, 2020, 12:49pm UTC](https://discuss.elastic.co/t/my-first-centralized-log-server/246002/3 "2020-08-23T12:49:14Z")
Dear ylarsy: Thanks for your words, let me explain better: Mikrotik devices store log lines locally on device memory. Is it very easy to export log lines to remote server. Then you can specify facility , severitiy and format RFC 3164 (syslog bsd) compatible. So , I think discussion here is which is easier to set: filebeats or logstash ? and what do you mean with "any broker" ? Regards. Leandro ---
**Author:** ![ylasri](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ylasri/32/86120_2.png) [@ylasri](https://discuss.elastic.co/u/ylasri)\ **Post date:** [August 23, 2020, 1:08pm UTC](https://discuss.elastic.co/t/my-first-centralized-log-server/246002/4 "2020-08-23T13:08:34Z")
If you can configure devices to send syslogs then you can setup directly logstash to receive syslogs and process them and send them back to elasticsearch. You can run ELK on the same server to start if you don't have too much volume of logs. You will need to use [logstash syslog input plugin](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-syslog.html) to receive syslogs from devices ---
**Author:** ![leostereo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leostereo/32/74891_2.png) [@leostereo](https://discuss.elastic.co/u/leostereo)\ **Post date:** [August 23, 2020, 10:42pm UTC](https://discuss.elastic.co/t/my-first-centralized-log-server/246002/5 "2020-08-23T22:42:26Z")
thanks! Il try. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [August 23, 2020, 10:52pm UTC](https://discuss.elastic.co/t/my-first-centralized-log-server/246002/6 "2020-08-23T22:52:56Z")
Filebeat also has a syslog input - [https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-syslog.html](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-syslog.html) ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 20, 2020, 10:52pm UTC](https://discuss.elastic.co/t/my-first-centralized-log-server/246002/7 "2020-09-20T22:52:58Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.