# Syslogging a Unifi Stack with Elastic Stack

**URL:** <https://discuss.elastic.co/t/syslogging-a-unifi-stack-with-elastic-stack/226483>\
**Category:** Logstash\
**Created:** [April 3, 2020, 10:38pm UTC](https://discuss.elastic.co/t/syslogging-a-unifi-stack-with-elastic-stack/226483 "2020-04-03T22:38:33Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![patrick\_kelly\_aci](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/patrick_kelly_aci/32/65650_2.png) [@patrick\_kelly\_aci](https://discuss.elastic.co/u/patrick_kelly_aci)\
**Post date:** [April 3, 2020, 10:38pm UTC](https://discuss.elastic.co/t/syslogging-a-unifi-stack-with-elastic-stack/226483/1 "2020-04-03T22:38:33Z")

</div>

So I wanted to start by stating that I am very new to Elastic Stack and I've been in IT for one year so my understanding of the way it works is very basic. I have completed the setup basic operations of Elastic Stack on a Windows Server 2016.

Here is the [guide](https://community.spiceworks.com/how_to/164166-installing-elk-7-elasticsearch-logstash-and-kibana-windows-server-2016-part-1) I used and went all the way through to Step 23 for reference.

My goal is to have Elastic Stack listening to logs from our UniFi Security Gateway XG-8 and there are settings in Unifi to set the IP and Port for a syslogging server. IP is pretty straight forward, but I'm not really sure what port I should send it through so that Logstash catches it.

Do I need to set this up with one of the beats?

Any help with this is much appreciated since my research time has been dramatically reduced because of recent events.

---

<div class="post-metadata">

**Author:** ![grumo35](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/grumo35/32/59451_2.png) [@grumo35](https://discuss.elastic.co/u/grumo35)\
**Post date:** [April 4, 2020, 12:33am UTC](https://discuss.elastic.co/t/syslogging-a-unifi-stack-with-elastic-stack/226483/2 "2020-04-04T00:33:41Z")

</div>

Hi,

The easiest way to do it would be to use filebeat as a secondary logshipper.

Using the following example -

[UniFi SG] ---\> [Syslog Server \> unifi.log \> Filebeat] ----\> [Logstash Server]

Specific products might not be able to send logs directly to logstash the best solution here is to first configure a basic Syslog Server get your log and then forward them using filebeat.

I can help with documentation if you have any questions.

---

<div class="post-metadata">

**Author:** ![patrick\_kelly\_aci](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/patrick_kelly_aci/32/65650_2.png) [@patrick\_kelly\_aci](https://discuss.elastic.co/u/patrick_kelly_aci)\
**Post date:** [April 4, 2020, 2:56am UTC](https://discuss.elastic.co/t/syslogging-a-unifi-stack-with-elastic-stack/226483/3 "2020-04-04T02:56:42Z")

</div>

This looks like a good place to start. I will look into getting Filebeat all setup.

Part of the issue I am running into is that once I've pointed it to the right location, how am I going to know that the log data is getting collected? It seems that the indexes are looking for terms inside of the log data.

If I am unfamiliar with Unifi's log terminology will Elasticsearch be able to show me common terms that it's receiving?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [April 5, 2020, 10:39am UTC](https://discuss.elastic.co/t/syslogging-a-unifi-stack-with-elastic-stack/226483/4 "2020-04-05T10:39:57Z")

</div>

Filebeat has a syslog input, so you can take it directly to that - [https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-syslog.html](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-syslog.html)

---

<div class="post-metadata">

**Author:** ![grumo35](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/grumo35/32/59451_2.png) [@grumo35](https://discuss.elastic.co/u/grumo35)\
**Post date:** [April 6, 2020, 3:33pm UTC](https://discuss.elastic.co/t/syslogging-a-unifi-stack-with-elastic-stack/226483/5 "2020-04-06T15:33:28Z")

</div>

If you make requests from Kibana to your Elasticsearch database for terms you'll have to parse the log message in order for Elasticsearch to build a document with fields and data.

Take a look at this documentation [https://www.elastic.co/guide/en/logstash/current/getting-started-with-logstash.html](https://www.elastic.co/guide/en/logstash/current/getting-started-with-logstash.html)

---

<div class="post-metadata">

**Author:** ![patrick\_kelly\_aci](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/patrick_kelly_aci/32/65650_2.png) [@patrick\_kelly\_aci](https://discuss.elastic.co/u/patrick_kelly_aci)\
**Post date:** [April 9, 2020, 8:51pm UTC](https://discuss.elastic.co/t/syslogging-a-unifi-stack-with-elastic-stack/226483/6 "2020-04-09T20:51:13Z")

</div>

That seems to be the way to do it and I did set up the input as follows in filebeat.yml file.

```auto
    - type: syslog

      protocol.udp:

        host: "localhost:9000"

```

I also commented out output for Elasticsearch and uncommented Logstash output with the host and mapped port. I have the Unifi Controller pointing to the host with the port 9000 and I'm not seeing a Filebeat Index Pattern in Kibana.  
I know it must be a configuration issue because I pointed the controller to the same host different port for Syslog Watcher and it was pulling logs just fine.

Any guidance? Does the syslog input require more variables like max\_message\_size?

---

<div class="post-metadata">

**Author:** ![grumo35](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/grumo35/32/59451_2.png) [@grumo35](https://discuss.elastic.co/u/grumo35)\
**Post date:** [April 10, 2020, 5:04pm UTC](https://discuss.elastic.co/t/syslogging-a-unifi-stack-with-elastic-stack/226483/7 "2020-04-10T17:04:46Z")

</div>

Hi, can you provide full configuration for beats and logstash ?

---

<div class="post-metadata">

**Author:** ![patrick\_kelly\_aci](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/patrick_kelly_aci/32/65650_2.png) [@patrick\_kelly\_aci](https://discuss.elastic.co/u/patrick_kelly_aci)\
**Post date:** [April 10, 2020, 8:33pm UTC](https://discuss.elastic.co/t/syslogging-a-unifi-stack-with-elastic-stack/226483/8 "2020-04-10T20:33:19Z")

</div>

Here is Logstash's logstash.conf file:

```auto
input {
  beats {
   port => 5044
   type => "syslog"
  }
}

output {
  elasticsearch {
    hosts => "localhost:9200"
    manage_template => false
    index => "%{[@metadata][beat]}-%{+yyyy.ww}"
    document_type => "%{[@metadata][type]}"
  }
}

```

Here is filebeat.yml file:

```auto
filebeat.inputs:

- type: syslog
  protocol.udp:
    host: "localhost:9000"
    
    paths:
    - C:\ProgramData\filebeat\logs\*.log

filebeat.config.modules:

    path: C:\ProgramData\Elastic\Beats\filebeat-7.6.1-windows-x86_64\modules.d\*.yml

    reload.enabled: false

setup.template.settings:

    index.number_of_shards: 1

setup.kibana:

    host: "localhost:5601"

output.logstash:

    hosts: ["localhost:5044"]

processors:
  - add_host_metadata: ~
  - add_cloud_metadata: ~
  - add_docker_metadata: ~
  - add_kubernetes_metadata: ~

```

Anything you don't see is commented out or not configured.

Let me know if you need any further details.

---

<div class="post-metadata">

**Author:** ![patrick\_kelly\_aci](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/patrick_kelly_aci/32/65650_2.png) [@patrick\_kelly\_aci](https://discuss.elastic.co/u/patrick_kelly_aci)\
**Post date:** [April 16, 2020, 11:33pm UTC](https://discuss.elastic.co/t/syslogging-a-unifi-stack-with-elastic-stack/226483/9 "2020-04-16T23:33:02Z")

</div>

Here is the new filebeat.yml that I setup. It's not picking up the logs from the Unifi Controller.

```auto
filebeat.inputs:
  - type: syslog
    enabled: true

protocol.udp:
  host: "localhost:514"

filebeat.config.modules:
  path: C:\ProgramData\Elastic\Beats\filebeat\modules.d\*.yml

reload.enabled: true
reload.period: 10s

setup.template.settings:
  index.number_of_shards: 1

output.logstash:
  hosts: "localhost:5044"

processors:
  - add_host_metadata: ~
  - add_cloud_metadata: ~
  - add_docker_metadata: ~
  - add_kubernetes_metadata: ~

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 14, 2020, 11:46pm UTC](https://discuss.elastic.co/t/syslogging-a-unifi-stack-with-elastic-stack/226483/10 "2020-05-14T23:46:27Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.