Stream logs to elastic search from Fastly

Elastic Observability Logs
1

I'm trying to find a way to stream logs from fastly.com to an elastic cloud service. According to Fastly's docs you are only able to do this through Logstash (which is not included in the cloud service). It seems impractical to have and manage a logstash instance for receiving logs from one source.

Anyone have tried to successfully stream logs from Fastly to Elastic search directly?

It seems the only way to stream logs to elastic is through beats.

2

Hi @soerenfrisk,

After looking through the list of supported log services in the docs you linked, two paths might be viable:

  1. Use logstash or filebeat to forward the syslog stream to Elasticsearch's HTTP API.
  2. Try to (ab)use one of the HTTP-based service integrations to submit JSON docs to an ingest pipeline on your Elasticserach cluster. If I were to attempt that, I would start with the sumologic integration, because it looks quite generic and configurable. I would point it at a small HTTP server which I control to inspect the format and derive a pipeline from that.
3

Hi!

Thanks for helping.

How would i go about forwarding the syslog through filebeat? Is there any docs on this? I've only used filebeat as something installed on a server.

4

Like logstash, filebeat would have to be set up on some server. Then it can consume syslog packets via its syslog input.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.