# Sending logs from Syslog-ng to Logstash with and without TLS

**URL:** <https://discuss.elastic.co/t/sending-logs-from-syslog-ng-to-logstash-with-and-without-tls/252939>\
**Category:** Logstash\
**Created:** [October 22, 2020, 6:25am UTC](https://discuss.elastic.co/t/sending-logs-from-syslog-ng-to-logstash-with-and-without-tls/252939 "2020-10-22T06:25:10Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Vishnuprasad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vishnuprasad/32/77667_2.png) [@Vishnuprasad](https://discuss.elastic.co/u/Vishnuprasad)\
**Post date:** [October 22, 2020, 6:25am UTC](https://discuss.elastic.co/t/sending-logs-from-syslog-ng-to-logstash-with-and-without-tls/252939/1 "2020-10-22T06:25:10Z")

</div>

Hello Explorers 🙂

Hope I could help you if you are looking to set up a Syslog-ng Logstash configuration to transfer logs from a Client server to Master server.

**Advantage of this setup:**

> If you have 100 Client servers, and you need to check a Specific/Multiple log files across all the 100 servers everyday. It would be a tiresome job.
> 
> Using this setup you can push multiple logs from 100 client servers to a single Master server in to specific files. _So logs of 100 client servers will be available in single Master server!!!_

**Architecture:**

Here, we have Syslog-ng as "Shipper" in the client side and Logstash as the service in the Server side to receive the logs from Client server.

**Pre-requisites:**

1. Here I have used 2 [CentOS-7-x86\_64-Minimal-2003.iso] VM servers spun up using VMware.

Note: Mirror- ([http://mirrors.piconets.webwerks.in/centos-mirror/7.8.2003/isos/x86\_64/CentOS-7-x86\_64-Minimal-2003.iso](http://mirrors.piconets.webwerks.in/centos-mirror/7.8.2003/isos/x86_64/CentOS-7-x86_64-Minimal-2003.iso))

1. Configured Java-1.8.0-openjdk.x86\_64, set Java home path on both machines.

2. Syslog-ng 3.29 on Client.

3. Logstash 7 in server side.

Lets have a look at this.

_ **Scenario:1 To transfer logs from Syslog-ng to Logstash WITHOUT TLS over TCP.** _

**Client-side Syslog-ng configuration**

```
source s_file {
    file("/var/log/messages");
};

destination d_syslog_tcp {
syslog("172.16.190.130" transport("tcp") port(6514));
 };

log {
    source(s_file);destination(d_syslog_tcp);
};

```

**Server-side Logstash configuration**  
Note: Make sure that you have changed the the user and group names in the file /etc/systemd/system/logstash.service from "logstash" to "root"

```
input {
 tcp {
    port => 6514
    mode => "server"
    type => "syslog"
  }
}

output {
   if [type] == "syslog" {

      file {
          path => "/root/logs/%{host}/%{+YYYY-MM-dd}.log"
      }
   }
}

```

_ **Scenario: 2 - To transfer logs from Syslog-ng to Logstash WITH TLS over TCP.** _

For creating the CA certificate, Client and Server certificate, please refer the official syslog-ng documentation:

CA and Server-side certificate creation =\>  
[https://www.syslog-ng.com/technical-documents/doc/syslog-ng-open-source-edition/3.26/mutual-authentication-using-tls](https://www.syslog-ng.com/technical-documents/doc/syslog-ng-open-source-edition/3.26/mutual-authentication-using-tls)

Client side certificate creation: =\>  
[https://www.syslog-ng.com/technical-documents/doc/syslog-ng-open-source-edition/3.26/mutual-authentication-using-tls/2#TOPIC-1430889](https://www.syslog-ng.com/technical-documents/doc/syslog-ng-open-source-edition/3.26/mutual-authentication-using-tls/2#TOPIC-1430889)

Configuring the certificates across the servers =\>  
[https://www.syslog-ng.com/technical-documents/doc/syslog-ng-open-source-edition/3.26/mutual-authentication-using-tls/2#TOPIC-1430890](https://www.syslog-ng.com/technical-documents/doc/syslog-ng-open-source-edition/3.26/mutual-authentication-using-tls/2#TOPIC-1430890)

**Client-side Syslog-ng TLS configuration**

```
source s_file {
    file("/var/log/messages");
};

destination d_tls_syslog {
syslog("172.16.190.130"
  transport("tls")
  port(6514)
  tls(
    key-file("/etc/syslog-ng/cert.d/clientkey.pem")
    cert-file("/etc/syslog-ng/cert.d/clientreq.pem")
    ca-dir("/etc/syslog-ng/ca.d")
    peer-verify(no)
    )
  );

};

log {
    source(s_file);destination(d_tls_syslog);
};

```

**Server-side Logstash configuration**  
Note: Make sure that you have changed the the user and group names in the file /etc/systemd/system/logstash.service from "logstash" to "root"

```
input {
 tcp {
  port => 6514
  mode => "server"
  type => syslog
  ssl_enable => true
  ssl_certificate_authorities => "/etc/logstash/ca.d/cacert.pem"
  ssl_cert => "/etc/logstash/serverreq.pem"
  ssl_key => "/etc/logstash/serverkey.pem"
  ssl_verify => false
 }
}

output {

      file {
          path => "/root/tls_logs/%{host}/%{+YYYY-MM-dd}.log"
      }
   }

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 19, 2020, 6:25am UTC](https://discuss.elastic.co/t/sending-logs-from-syslog-ng-to-logstash-with-and-without-tls/252939/2 "2020-11-19T06:25:22Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.