SYSLOG-NG, Filebeat-Logstash-elasticsearch-Kibana - Suggestion!

[ramindia (R!)]

Hi All

We have centralize logging server setup across network.

All the devices of Cisco or other devices send logs to SYSLOG-NG Server. they store in based on the IP and date and time as in folder.

Now i would like to take that date and create a easy dashboard and alert system.

I am thinking to 2 options here.

1. SYSLOG-NG --File-beat--Logstasg-ElasticSearch-Kibana
2. SYSLOG-NG --Logstasg-ElasticSearch-Kibana

What is your suggestion ?

Thank you
R!

[czanik (Peter Czanik)]

You can also simplify it to syslog-ng -> elasticsearch -> Kibana: https://www.balabit.com/blog/logging-to-elasticsearch-made-simple-with-syslog-ng/

[ramindia (R!)]

Thank you, i have seen that post already,

As per my understanding, new syslog-ng can directly send the logs to elasticsearch.

But i am looking some normalization before sending to elasticsearch, due to heavy traffic from ASA or Checkpoint.

So i was thinking to use use logstash between, make sense ?

R!