# Send all routers, switches and access points logs to ELK server

**URL:** <https://discuss.elastic.co/t/send-all-routers-switches-and-access-points-logs-to-elk-server/238289>\
**Category:** Beats\
**Created:** [June 23, 2020, 2:54pm UTC](https://discuss.elastic.co/t/send-all-routers-switches-and-access-points-logs-to-elk-server/238289 "2020-06-23T14:54:15Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![jelocabral](https://avatars.discourse-cdn.com/v4/letter/j/e0b2c6/32.png) [@jelocabral](https://discuss.elastic.co/u/jelocabral)\
**Post date:** [June 23, 2020, 2:54pm UTC](https://discuss.elastic.co/t/send-all-routers-switches-and-access-points-logs-to-elk-server/238289/1 "2020-06-23T14:54:15Z")

</div>

Hi people, I have several routers, switches and acces points in my network and I want to send all their logs to a syslog service implemented in my ELK server.

Is this possible to implement a syslog server listening on UDP/514 port through the filebeat agent installed in the own ELK server?

I have to point:

Routers, Switches, AP's ---\> UDP/514 Syslog service in Filebeat from ELK server

Thanks a lot !!!

---

<div class="post-metadata">

**Author:** ![philippkahr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/philippkahr/32/100137_2.png) [@philippkahr](https://discuss.elastic.co/u/philippkahr)\
**Post date:** [June 23, 2020, 3:16pm UTC](https://discuss.elastic.co/t/send-all-routers-switches-and-access-points-logs-to-elk-server/238289/2 "2020-06-23T15:16:18Z")

</div>

Yes, depending on the amount of data you might want to have an own server for filebeat.

---

<div class="post-metadata">

**Author:** ![jelocabral](https://avatars.discourse-cdn.com/v4/letter/j/e0b2c6/32.png) [@jelocabral](https://discuss.elastic.co/u/jelocabral)\
**Post date:** [June 23, 2020, 4:29pm UTC](https://discuss.elastic.co/t/send-all-routers-switches-and-access-points-logs-to-elk-server/238289/3 "2020-06-23T16:29:03Z")

</div>

Thanks a lot.

But I've read that it's possible to use Logstash to generate a UDP/514 port for incoming logs.

Which is better for listening syslog input, filebeat or logstash ?

Thanks again !

---

<div class="post-metadata">

**Author:** ![philippkahr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/philippkahr/32/100137_2.png) [@philippkahr](https://discuss.elastic.co/u/philippkahr)\
**Post date:** [June 23, 2020, 5:30pm UTC](https://discuss.elastic.co/t/send-all-routers-switches-and-access-points-logs-to-elk-server/238289/4 "2020-06-23T17:30:18Z")

</div>

It basically depends, there is no "better" or "worse".

E.g. filebeat has support for specific switches such as Cisco iOS or Firewalls as Cisco ASA and Fortinet. [https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-modules.html](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-modules.html) In Logstash you would have to write your own pipeline and do splitting of the fields and mapping by yourself.

I would go with filebeat and send e.g. Cisco iOS switches to a specific port, firewalls to a specific port and so on.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 21, 2020, 7:30pm UTC](https://discuss.elastic.co/t/send-all-routers-switches-and-access-points-logs-to-elk-server/238289/5 "2020-07-21T19:30:21Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.