Hi - I can't seem to get Filebeat to collect syslog from ONLY my network devices. It seems to collect everything from /var/log/messages (Filebeat installed on Centos 7) and from my network devices.
Here are the input/output parts of my filebeat.yml:
The end result is that in Elasticsearch I am seeing all logs from /var/log/messages and from the network devices, instead of only from the network devices.
Since you want to collect only network inputs you need to disable system module.
Most probably it is module.d/system.yml that is responsible for collecting the log messages from /var/log/.
But if I disable the system module won't that disable the syslog ingest pipeline? I want these logs to appear in the "Dashboards [Filebeat System] ECS". Is that the best ES dashboard to use for this?
My apologies - I did not understand - I assumed that the pre-built syslog dashboard could be applied to network syslog. I see now that this dashboard is only for linux/unix syslog.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.