Network devices logs monitoring

Elastic Stack Logstash
1

Hi Team,
I am new in ELK, and I am looking to monitor my network infra logs, We are using below vendors devices :-
Cisco
Sonic wall
Fortinet

At network end all log forwarding is configured on UDP 5014 port for all devices, logstash are receiving all logs, logstash config file:-

input {
tcp {
port => 5014
type => syslog
}
udp {
port => 5014
type => syslog
}
}

filter {
if [type] == "syslog" {
grok {
match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:[%{POSINT:syslog_pid}])?: %{GREEDYDATA:syslog_message}" }
add_field => [ "received_at", "%{@timestamp}" ]
add_field => [ "received_from", "%{host}" ]
}
date {
match => [ "syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss" ]
}
}
}

output {
elasticsearch {
hosts => ["localhost:9200"]
user => elastic
password => elastic
}
stdout { codec => rubydebug }
}

Currently I am receiving all logs, but I have few query -

  1. there is no such info like Firewall, route etc. so how can I identify device details ? or Is there any other better process to collect Network devices log
2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.