Send all routers, switches and access points logs to ELK server

Hi people, I have several routers, switches and acces points in my network and I want to send all their logs to a syslog service implemented in my ELK server.

Is this possible to implement a syslog server listening on UDP/514 port through the filebeat agent installed in the own ELK server?

I have to point:

Routers, Switches, AP's ---> UDP/514 Syslog service in Filebeat from ELK server

Thanks a lot !!!

Yes, depending on the amount of data you might want to have an own server for filebeat.

Thanks a lot.

But I've read that it's possible to use Logstash to generate a UDP/514 port for incoming logs.

Which is better for listening syslog input, filebeat or logstash ?

Thanks again !

It basically depends, there is no "better" or "worse".

E.g. filebeat has support for specific switches such as Cisco iOS or Firewalls as Cisco ASA and Fortinet. In Logstash you would have to write your own pipeline and do splitting of the fields and mapping by yourself.

I would go with filebeat and send e.g. Cisco iOS switches to a specific port, firewalls to a specific port and so on.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.