Hi, I'm just getting familiar with Elastic Stack, and implementing ELK with Filebeat to a syslog server that receives the syslogs from various routers on a network.
The routers are running RouterOS on mikrotik routers, which I believe is set-up properly to send the data.
Then Filebeat is configured to receive on the same port via the syslog config settings. This appears to be functioning, as netstat shows the ports to be listening/available.
The next step I am a bit lost for is what I need to do so the rest of the stack communicates and parses/visualizes the data.
Logstash is set up simply to listen to Filebeat and output to Elasticsearch/kibana
I cannot find any Elasticsearch modules that deal with general syslogs other than for the host server logs (System module), and all other modules appear to deal with proprietary equipment.
Do I need to create ingest pipelines specifically to read the data from Mikrotik/RouterOS? Even though they supposedly ship data in BSD format? If so, which program should I do this in? Filebeat? Logstash? or Elasticsearch/kibana?
And afterwards, I assume I will have to create a custom dashboard, but I think I can figure that out as long as I can find where the data is from the routers.
What am I missing in order to begin seeing stats from these routers? Thank you in advance!